cyber-dojo
flows
nginx-archived-at-1707630884
artifacts
b9e72784672f1d1dc907947a30a5b4276eb219cc36f8da978486e5aa1e93eece
By signing up, you agree to the
Terms of Service.
For more information about Kosli’s privacy practices, see the Kosli’s
Privacy Policy.
We’ll occasionally send you account-related emails.
We’ll occasionally send you account-related emails.
nginx-archived-at-1707630884
Reverse proxy
cyberdojo/nginx:e29d5d9
Non-compliant
Download Evidence Package
JSON
{
"created_at": 1693541454.7223034,
"fingerprint": "b9e72784672f1d1dc907947a30a5b4276eb219cc36f8da978486e5aa1e93eece",
"filename": "cyberdojo/nginx:e29d5d9",
"git_commit": "e29d5d9469d0c432e8b5ba26e3e8a7b84e419bcf",
"build_url": "https://github.com/cyber-dojo/nginx/actions/runs/6045302819",
"commit_url": "https://github.com/cyber-dojo/nginx/commit/e29d5d9469d0c432e8b5ba26e3e8a7b84e419bcf",
"evidence": {
"snyk-scan": {
"evidence_type": "snyk",
"is_compliant": false,
"build_url": "https://github.com/cyber-dojo/nginx/actions/runs/6045302819",
"evidence_archive_fingerprint": "e9f6962dbc4613c31602651d47223b097b9a723aaef53d5b0f046bede38da03b",
"user_data": {},
"snyk_results": {
"applications": [
{
"dependencyCount": 0,
"displayTargetFile": "/usr/share/java",
"docker": {},
"filesystemPolicy": false,
"hasUnknownVersions": false,
"ignoreSettings": {
"adminOnly": false,
"disregardFilesystemIgnores": false,
"reasonRequired": false
},
"isPrivate": true,
"licensesPolicy": {
"orgLicenseRules": {
"AGPL-1.0": {
"instructions": "",
"licenseType": "AGPL-1.0",
"severity": "high"
},
"AGPL-3.0": {
"instructions": "",
"licenseType": "AGPL-3.0",
"severity": "high"
},
"Artistic-1.0": {
"instructions": "",
"licenseType": "Artistic-1.0",
"severity": "medium"
},
"Artistic-2.0": {
"instructions": "",
"licenseType": "Artistic-2.0",
"severity": "medium"
},
"CDDL-1.0": {
"instructions": "",
"licenseType": "CDDL-1.0",
"severity": "medium"
},
"CPOL-1.02": {
"instructions": "",
"licenseType": "CPOL-1.02",
"severity": "high"
},
"EPL-1.0": {
"instructions": "",
"licenseType": "EPL-1.0",
"severity": "medium"
},
"GPL-2.0": {
"instructions": "",
"licenseType": "GPL-2.0",
"severity": "high"
},
"GPL-3.0": {
"instructions": "",
"licenseType": "GPL-3.0",
"severity": "high"
},
"LGPL-2.0": {
"instructions": "",
"licenseType": "LGPL-2.0",
"severity": "medium"
},
"LGPL-2.1": {
"instructions": "",
"licenseType": "LGPL-2.1",
"severity": "medium"
},
"LGPL-3.0": {
"instructions": "",
"licenseType": "LGPL-3.0",
"severity": "medium"
},
"MPL-1.1": {
"instructions": "",
"licenseType": "MPL-1.1",
"severity": "medium"
},
"MPL-2.0": {
"instructions": "",
"licenseType": "MPL-2.0",
"severity": "medium"
},
"MS-RL": {
"instructions": "",
"licenseType": "MS-RL",
"severity": "medium"
},
"SimPL-2.0": {
"instructions": "",
"licenseType": "SimPL-2.0",
"severity": "high"
}
},
"severities": {}
},
"ok": true,
"org": "fayesgw",
"packageManager": "maven",
"path": "cyberdojo/nginx:e29d5d9/nginx:e29d5d9:/usr/share/java",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"projectName": "cyberdojo/nginx:e29d5d9:/usr/share/java",
"summary": "No known vulnerabilities",
"targetFile": "/usr/share/java",
"uniqueCount": 0,
"vulnerabilities": []
}
],
"dependencyCount": 149,
"docker": {
"baseImage": "nginx:1.25.2-bookworm",
"baseImageRemediation": {
"advice": [
{
"bold": true,
"message": "According to our scan, you are currently using the most secure version of the selected base image"
}
],
"code": "NO_REMEDIATION_AVAILABLE"
}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"hasUnknownVersions": false,
"ignoreSettings": {
"adminOnly": false,
"disregardFilesystemIgnores": false,
"reasonRequired": false
},
"isPrivate": true,
"licensesPolicy": {
"orgLicenseRules": {
"AGPL-1.0": {
"instructions": "",
"licenseType": "AGPL-1.0",
"severity": "high"
},
"AGPL-3.0": {
"instructions": "",
"licenseType": "AGPL-3.0",
"severity": "high"
},
"Artistic-1.0": {
"instructions": "",
"licenseType": "Artistic-1.0",
"severity": "medium"
},
"Artistic-2.0": {
"instructions": "",
"licenseType": "Artistic-2.0",
"severity": "medium"
},
"CDDL-1.0": {
"instructions": "",
"licenseType": "CDDL-1.0",
"severity": "medium"
},
"CPOL-1.02": {
"instructions": "",
"licenseType": "CPOL-1.02",
"severity": "high"
},
"EPL-1.0": {
"instructions": "",
"licenseType": "EPL-1.0",
"severity": "medium"
},
"GPL-2.0": {
"instructions": "",
"licenseType": "GPL-2.0",
"severity": "high"
},
"GPL-3.0": {
"instructions": "",
"licenseType": "GPL-3.0",
"severity": "high"
},
"LGPL-2.0": {
"instructions": "",
"licenseType": "LGPL-2.0",
"severity": "medium"
},
"LGPL-2.1": {
"instructions": "",
"licenseType": "LGPL-2.1",
"severity": "medium"
},
"LGPL-3.0": {
"instructions": "",
"licenseType": "LGPL-3.0",
"severity": "medium"
},
"MPL-1.1": {
"instructions": "",
"licenseType": "MPL-1.1",
"severity": "medium"
},
"MPL-2.0": {
"instructions": "",
"licenseType": "MPL-2.0",
"severity": "medium"
},
"MS-RL": {
"instructions": "",
"licenseType": "MS-RL",
"severity": "medium"
},
"SimPL-2.0": {
"instructions": "",
"licenseType": "SimPL-2.0",
"severity": "high"
}
},
"severities": {}
},
"ok": false,
"org": "fayesgw",
"packageManager": "deb",
"path": "cyberdojo/nginx:e29d5d9/nginx",
"platform": "linux/amd64",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"projectName": "docker-image|cyberdojo/nginx",
"summary": "212 vulnerable dependency paths",
"uniqueCount": 71,
"vulnerabilities": [
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-09-01T12:08:59.933511Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-09-01T01:11:04.467161Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `aom` package and not the `aom` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.\n## Remediation\nThere is no fixed version for `Debian:12` `aom`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39616)\n- [cve@mitre.org](https://bugs.chromium.org/p/aomedia/issues/detail?id=3372#c3)\n",
"disclosureTime": "2023-08-29T17:15:12.633000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.13960",
"probability": "0.00046"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libavif/libavif15@0.11.1-1",
"aom/libaom3@3.6.0-1"
],
"id": "SNYK-DEBIAN12-AOM-5878995",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-39616"
],
"CWE": [
"CWE-119"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-03T00:08:57.363811Z",
"name": "aom/libaom3",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "aom",
"patches": [],
"publicationTime": "2023-09-01T12:08:51.487137Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-39616"
},
{
"title": "cve@mitre.org",
"url": "https://bugs.chromium.org/p/aomedia/issues/detail?id=3372%23c3"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-Bounds",
"upgradePath": [],
"version": "3.6.0-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-09-01T12:08:59.933511Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-09-01T01:11:04.467161Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `aom` package and not the `aom` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.\n## Remediation\nThere is no fixed version for `Debian:12` `aom`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39616)\n- [cve@mitre.org](https://bugs.chromium.org/p/aomedia/issues/detail?id=3372#c3)\n",
"disclosureTime": "2023-08-29T17:15:12.633000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.13960",
"probability": "0.00046"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libheif/libheif1@1.15.1-1",
"aom/libaom3@3.6.0-1"
],
"id": "SNYK-DEBIAN12-AOM-5878995",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-39616"
],
"CWE": [
"CWE-119"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-03T00:08:57.363811Z",
"name": "aom/libaom3",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "aom",
"patches": [],
"publicationTime": "2023-09-01T12:08:51.487137Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-39616"
},
{
"title": "cve@mitre.org",
"url": "https://bugs.chromium.org/p/aomedia/issues/detail?id=3372%23c3"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-Bounds",
"upgradePath": [],
"version": "3.6.0-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:49:48.195350Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 3.7,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2022-01-03T17:20:43.650545Z",
"severity": "low"
}
],
"cvssScore": 3.7,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `apt` package and not the `apt` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIt was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.\n## Remediation\nThere is no fixed version for `Debian:12` `apt`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3374)\n- [Debian Bug Report](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480)\n- [MISC](https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html)\n- [MISC](https://seclists.org/fulldisclosure/2011/Sep/221)\n- [MISC](https://snyk.io/vuln/SNYK-LINUX-APT-116518)\n- [MISC](https://ubuntu.com/security/CVE-2011-3374)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/cve-2011-3374)\n",
"disclosureTime": "2019-11-26T00:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51982",
"probability": "0.00164"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt/libapt-pkg6.0@2.6.1"
],
"id": "SNYK-DEBIAN12-APT-1541449",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2011-3374"
],
"CWE": [
"CWE-347"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-11-01T00:08:27.375895Z",
"name": "apt/libapt-pkg6.0",
"nvdSeverity": "low",
"packageManager": "debian:12",
"packageName": "apt",
"patches": [],
"publicationTime": "2018-06-27T16:20:45.037549Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2011-3374"
},
{
"title": "Debian Bug Report",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480"
},
{
"title": "MISC",
"url": "https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html"
},
{
"title": "MISC",
"url": "https://seclists.org/fulldisclosure/2011/Sep/221"
},
{
"title": "MISC",
"url": "https://snyk.io/vuln/SNYK-LINUX-APT-116518"
},
{
"title": "MISC",
"url": "https://ubuntu.com/security/CVE-2011-3374"
},
{
"title": "RedHat CVE Database",
"url": "https://access.redhat.com/security/cve/cve-2011-3374"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Verification of Cryptographic Signature",
"upgradePath": [],
"version": "2.6.1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:49:48.195350Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 3.7,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2022-01-03T17:20:43.650545Z",
"severity": "low"
}
],
"cvssScore": 3.7,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `apt` package and not the `apt` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIt was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.\n## Remediation\nThere is no fixed version for `Debian:12` `apt`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3374)\n- [Debian Bug Report](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480)\n- [MISC](https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html)\n- [MISC](https://seclists.org/fulldisclosure/2011/Sep/221)\n- [MISC](https://snyk.io/vuln/SNYK-LINUX-APT-116518)\n- [MISC](https://ubuntu.com/security/CVE-2011-3374)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/cve-2011-3374)\n",
"disclosureTime": "2019-11-26T00:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51982",
"probability": "0.00164"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1"
],
"id": "SNYK-DEBIAN12-APT-1541449",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2011-3374"
],
"CWE": [
"CWE-347"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-11-01T00:08:27.375895Z",
"name": "apt/libapt-pkg6.0",
"nvdSeverity": "low",
"packageManager": "debian:12",
"packageName": "apt",
"patches": [],
"publicationTime": "2018-06-27T16:20:45.037549Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2011-3374"
},
{
"title": "Debian Bug Report",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480"
},
{
"title": "MISC",
"url": "https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html"
},
{
"title": "MISC",
"url": "https://seclists.org/fulldisclosure/2011/Sep/221"
},
{
"title": "MISC",
"url": "https://snyk.io/vuln/SNYK-LINUX-APT-116518"
},
{
"title": "MISC",
"url": "https://ubuntu.com/security/CVE-2011-3374"
},
{
"title": "RedHat CVE Database",
"url": "https://access.redhat.com/security/cve/cve-2011-3374"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Verification of Cryptographic Signature",
"upgradePath": [],
"version": "2.6.1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:49:48.195350Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 3.7,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2022-01-03T17:20:43.650545Z",
"severity": "low"
}
],
"cvssScore": 3.7,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `apt` package and not the `apt` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIt was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.\n## Remediation\nThere is no fixed version for `Debian:12` `apt`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3374)\n- [Debian Bug Report](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480)\n- [MISC](https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html)\n- [MISC](https://seclists.org/fulldisclosure/2011/Sep/221)\n- [MISC](https://snyk.io/vuln/SNYK-LINUX-APT-116518)\n- [MISC](https://ubuntu.com/security/CVE-2011-3374)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/cve-2011-3374)\n",
"disclosureTime": "2019-11-26T00:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51982",
"probability": "0.00164"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1"
],
"id": "SNYK-DEBIAN12-APT-1541449",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2011-3374"
],
"CWE": [
"CWE-347"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-11-01T00:08:27.375895Z",
"name": "apt",
"nvdSeverity": "low",
"packageManager": "debian:12",
"packageName": "apt",
"patches": [],
"publicationTime": "2018-06-27T16:20:45.037549Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2011-3374"
},
{
"title": "Debian Bug Report",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480"
},
{
"title": "MISC",
"url": "https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html"
},
{
"title": "MISC",
"url": "https://seclists.org/fulldisclosure/2011/Sep/221"
},
{
"title": "MISC",
"url": "https://snyk.io/vuln/SNYK-LINUX-APT-116518"
},
{
"title": "MISC",
"url": "https://ubuntu.com/security/CVE-2011-3374"
},
{
"title": "RedHat CVE Database",
"url": "https://access.redhat.com/security/cve/cve-2011-3374"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Verification of Cryptographic Signature",
"upgradePath": [],
"version": "2.6.1"
},
{
"CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:51:16.959003Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"modificationTime": "2022-01-03T17:47:58.488186Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 8.6,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"modificationTime": "2022-09-01T14:17:34.337978Z",
"severity": "high"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `coreutils` package and not the `coreutils` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nchroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.\n## Remediation\nThere is no fixed version for `Debian:12` `coreutils`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2016-2781)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2016/02/28/2)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2016/02/28/3)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2781)\n",
"disclosureTime": "2017-02-07T15:59:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"coreutils@9.1-1"
],
"id": "SNYK-DEBIAN12-COREUTILS-1543939",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2016-2781"
],
"CWE": [
"CWE-20"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-28T00:20:47.372219Z",
"name": "coreutils",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "coreutils",
"patches": [],
"publicationTime": "2017-02-07T15:59:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2016-2781"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2016/02/28/2"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2016/02/28/3"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2781"
}
],
"relativeImportance": "low",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Input Validation",
"upgradePath": [],
"version": "9.1-1"
},
{
"CVSSv3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:51:17.267032Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.7,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2022-01-03T16:23:18.037192Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.2,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
"modificationTime": "2022-11-27T19:09:01.718634Z",
"severity": "medium"
}
],
"cvssScore": 4.7,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `coreutils` package and not the `coreutils` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.\n## Remediation\nThere is no fixed version for `Debian:12` `coreutils`.\n## References\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18018)\n- [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2017-18018)\n- [http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html](http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html)\n",
"disclosureTime": "2018-01-04T04:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"coreutils@9.1-1"
],
"id": "SNYK-DEBIAN12-COREUTILS-1543947",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2017-18018"
],
"CWE": [
"CWE-362"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:27.811342Z",
"name": "coreutils",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "coreutils",
"patches": [],
"publicationTime": "2018-01-04T04:29:00Z",
"references": [
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18018"
},
{
"title": "Debian Security Tracker",
"url": "https://security-tracker.debian.org/tracker/CVE-2017-18018"
},
{
"title": "http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html",
"url": "http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Race Condition",
"upgradePath": [],
"version": "9.1-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-05-11T00:22:44.040933Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "SUSE",
"cvssV3BaseScore": 2.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"modificationTime": "2023-06-24T11:04:08.954791Z",
"severity": "low"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-05-17T01:10:16.232297Z",
"severity": "medium"
}
],
"cvssScore": 5.9,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `dav1d` package and not the `dav1d` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nVideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.\n## Remediation\nThere is no fixed version for `Debian:12` `dav1d`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-32570)\n- [cve@mitre.org](https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa)\n- [cve@mitre.org](https://code.videolan.org/videolan/dav1d/-/tags/1.2.0)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/)\n",
"disclosureTime": "2023-05-10T05:15:12.190000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.17973",
"probability": "0.00052"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libavif/libavif15@0.11.1-1",
"dav1d/libdav1d6@1.0.0-2"
],
"id": "SNYK-DEBIAN12-DAV1D-5518047",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-32570"
],
"CWE": [
"CWE-362"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-07-08T13:12:17.809031Z",
"name": "dav1d/libdav1d6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "dav1d",
"patches": [],
"publicationTime": "2023-05-11T00:22:43.983561Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-32570"
},
{
"title": "cve@mitre.org",
"url": "https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa"
},
{
"title": "cve@mitre.org",
"url": "https://code.videolan.org/videolan/dav1d/-/tags/1.2.0"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Race Condition",
"upgradePath": [],
"version": "1.0.0-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-05-11T00:22:44.040933Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "SUSE",
"cvssV3BaseScore": 2.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"modificationTime": "2023-06-24T11:04:08.954791Z",
"severity": "low"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-05-17T01:10:16.232297Z",
"severity": "medium"
}
],
"cvssScore": 5.9,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `dav1d` package and not the `dav1d` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nVideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.\n## Remediation\nThere is no fixed version for `Debian:12` `dav1d`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-32570)\n- [cve@mitre.org](https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa)\n- [cve@mitre.org](https://code.videolan.org/videolan/dav1d/-/tags/1.2.0)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/)\n",
"disclosureTime": "2023-05-10T05:15:12.190000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.17973",
"probability": "0.00052"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libheif/libheif1@1.15.1-1",
"dav1d/libdav1d6@1.0.0-2"
],
"id": "SNYK-DEBIAN12-DAV1D-5518047",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-32570"
],
"CWE": [
"CWE-362"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-07-08T13:12:17.809031Z",
"name": "dav1d/libdav1d6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "dav1d",
"patches": [],
"publicationTime": "2023-05-11T00:22:43.983561Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-32570"
},
{
"title": "cve@mitre.org",
"url": "https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa"
},
{
"title": "cve@mitre.org",
"url": "https://code.videolan.org/videolan/dav1d/-/tags/1.2.0"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Race Condition",
"upgradePath": [],
"version": "1.0.0-2"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libheif/libheif1@1.15.1-1",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-njs@1.25.2+0.8.0-1~bookworm",
"libxml2@2.9.14+dfsg-1.3~deb12u1",
"icu/libicu72@72.1-3",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libavif/libavif15@0.11.1-1",
"libgav1/libgav1-1@0.18.0-1+b1",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libavif/libavif15@0.11.1-1",
"libyuv/libyuv0@0.0~git20230123.b2528b0-1",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libheif/libheif1@1.15.1-1",
"libde265/libde265-0@1.0.11-1",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libheif/libheif1@1.15.1-1",
"x265/libx265-199@3.5-2+b1",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6",
"lerc/liblerc4@4.0.0+ds-2",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libavif/libavif15@0.11.1-1",
"libgav1/libgav1-1@0.18.0-1+b1",
"abseil/libabsl20220623@20220623.1-1",
"gcc-12/libstdc++6@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libstdc++6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"gcc-12/gcc-12-base@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/gcc-12-base",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-11T00:43:26.423127Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-11T01:10:45.368544Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-19T15:46:28.941551Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-22T11:06:50.121676Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n",
"disclosureTime": "2022-03-26T13:15:07.900000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.16256",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"gcc-12/libgcc-s1@12.2.0-14"
],
"id": "SNYK-DEBIAN12-GCC12-2606941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-27943"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:37:15.761957Z",
"name": "gcc-12/libgcc-s1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gcc-12",
"patches": [],
"publicationTime": "2022-04-11T00:42:57.529751Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-27943"
},
{
"title": "cve@mitre.org",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"title": "cve@mitre.org",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "12.2.0-14"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:53:08.248256Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-01-03T17:53:36.633029Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-09-01T21:32:37.683695Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010024)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22852)\n- [Security Focus](http://www.securityfocus.com/bid/109162)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010024)\n",
"disclosureTime": "2019-07-15T04:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.88010",
"probability": "0.02258"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc-bin@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1546991",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-1010024"
],
"CWE": [
"CWE-200"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-26T02:06:01.383285Z",
"name": "glibc/libc-bin",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-07-24T09:44:44.882448Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-1010024"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K06046097"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22852"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/109162"
},
{
"title": "UBUNTU",
"url": "https://ubuntu.com/security/CVE-2019-1010024"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:53:10.214107Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-01-03T16:26:27.939810Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2022-10-26T21:47:02.137823Z",
"severity": "medium"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-20796)\n- [CONFIRM](https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141)\n- [MISC](https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html)\n- [Netapp Security Advisory](https://security.netapp.com/advisory/ntap-20190315-0002/)\n- [Security Focus](http://www.securityfocus.com/bid/107160)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796)\n",
"disclosureTime": "2019-02-26T02:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.73119",
"probability": "0.00503"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc-bin@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547039",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-20796"
],
"CWE": [
"CWE-674"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:45.808877Z",
"name": "glibc/libc-bin",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-02-26T02:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-20796"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141"
},
{
"title": "MISC",
"url": "https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html"
},
{
"title": "Netapp Security Advisory",
"url": "https://security.netapp.com/advisory/ntap-20190315-0002/"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/107160"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Uncontrolled Recursion",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:53:11.542599Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-01-03T18:01:31.673539Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-9192)\n- [CONFIRM](https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=24269)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192)\n",
"disclosureTime": "2019-02-26T18:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.42606",
"probability": "0.00108"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc-bin@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547069",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-9192"
],
"CWE": [
"CWE-674"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-26T02:05:07.667771Z",
"name": "glibc/libc-bin",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-02-26T18:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-9192"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24269"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Uncontrolled Recursion",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:53:14.271602Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-01-03T17:53:25.533412Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 2.9,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-09-01T21:32:02.716925Z",
"severity": "low"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010025)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22853)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010025)\n",
"disclosureTime": "2019-07-15T04:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.62117",
"probability": "0.00255"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc-bin@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547135",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-1010025"
],
"CWE": [
"CWE-330"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-26T02:06:12.573238Z",
"name": "glibc/libc-bin",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-07-24T09:33:59.230537Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-1010025"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K06046097"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853"
},
{
"title": "UBUNTU",
"url": "https://ubuntu.com/security/CVE-2019-1010025"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Use of Insufficiently Random Values",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:53:16.627675Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 9.8,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T17:53:20.558676Z",
"severity": "critical"
}
],
"cvssScore": 9.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010022)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22850)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010022)\n",
"disclosureTime": "2019-07-15T04:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.67160",
"probability": "0.00335"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc-bin@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547196",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-1010022"
],
"CWE": [
"CWE-119"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-26T02:04:58.132579Z",
"name": "glibc/libc-bin",
"nvdSeverity": "critical",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-07-24T09:33:32.251091Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-1010022"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22850"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22850%23c3"
},
{
"title": "UBUNTU",
"url": "https://ubuntu.com/security/CVE-2019-1010022"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-Bounds",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:53:21.660641Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-02-09T11:23:31.120244Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-02-09T11:25:01.944790Z",
"severity": "medium"
}
],
"cvssScore": 4.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-4756)\n- [http://cxib.net/stuff/glob-0day.c](http://cxib.net/stuff/glob-0day.c)\n- [http://securityreason.com/achievement_securityalert/89](http://securityreason.com/achievement_securityalert/89)\n- [http://securityreason.com/exploitalert/9223](http://securityreason.com/exploitalert/9223)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=681681)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756)\n",
"disclosureTime": "2011-03-02T20:00:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.79552",
"probability": "0.00824"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc-bin@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547293",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2010-4756"
],
"CWE": [
"CWE-399"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:43.085188Z",
"name": "glibc/libc-bin",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2011-03-02T20:00:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-4756"
},
{
"title": "http://cxib.net/stuff/glob-0day.c",
"url": "http://cxib.net/stuff/glob-0day.c"
},
{
"title": "http://securityreason.com/achievement_securityalert/89",
"url": "http://securityreason.com/achievement_securityalert/89"
},
{
"title": "http://securityreason.com/exploitalert/9223",
"url": "http://securityreason.com/exploitalert/9223"
},
{
"title": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=681681"
},
{
"title": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Management Errors",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:53:24.764385Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T17:53:36.820375Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.8,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"modificationTime": "2022-11-27T20:32:48.179719Z",
"severity": "high"
}
],
"cvssScore": 8.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010023)\n- [CONFIRM](https://support.f5.com/csp/article/K11932200?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22851)\n- [Security Focus](http://www.securityfocus.com/bid/109167)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010023)\n",
"disclosureTime": "2019-07-15T04:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.82178",
"probability": "0.01070"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc-bin@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547373",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-1010023"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-11-27T20:32:48.179719Z",
"name": "glibc/libc-bin",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-07-24T09:36:38.241516Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-1010023"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22851"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/109167"
},
{
"title": "UBUNTU",
"url": "https://ubuntu.com/security/CVE-2019-1010023"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2019-1010023",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:53:08.248256Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-01-03T17:53:36.633029Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-09-01T21:32:37.683695Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010024)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22852)\n- [Security Focus](http://www.securityfocus.com/bid/109162)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010024)\n",
"disclosureTime": "2019-07-15T04:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.88010",
"probability": "0.02258"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc6@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1546991",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-1010024"
],
"CWE": [
"CWE-200"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-26T02:06:01.383285Z",
"name": "glibc/libc6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-07-24T09:44:44.882448Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-1010024"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K06046097"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22852"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/109162"
},
{
"title": "UBUNTU",
"url": "https://ubuntu.com/security/CVE-2019-1010024"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:53:10.214107Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-01-03T16:26:27.939810Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2022-10-26T21:47:02.137823Z",
"severity": "medium"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-20796)\n- [CONFIRM](https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141)\n- [MISC](https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html)\n- [Netapp Security Advisory](https://security.netapp.com/advisory/ntap-20190315-0002/)\n- [Security Focus](http://www.securityfocus.com/bid/107160)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796)\n",
"disclosureTime": "2019-02-26T02:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.73119",
"probability": "0.00503"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc6@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547039",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-20796"
],
"CWE": [
"CWE-674"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:45.808877Z",
"name": "glibc/libc6",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-02-26T02:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-20796"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141"
},
{
"title": "MISC",
"url": "https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html"
},
{
"title": "Netapp Security Advisory",
"url": "https://security.netapp.com/advisory/ntap-20190315-0002/"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/107160"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Uncontrolled Recursion",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:53:11.542599Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-01-03T18:01:31.673539Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-9192)\n- [CONFIRM](https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=24269)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192)\n",
"disclosureTime": "2019-02-26T18:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.42606",
"probability": "0.00108"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc6@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547069",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-9192"
],
"CWE": [
"CWE-674"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-26T02:05:07.667771Z",
"name": "glibc/libc6",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-02-26T18:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-9192"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24269"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Uncontrolled Recursion",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:53:14.271602Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-01-03T17:53:25.533412Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 2.9,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-09-01T21:32:02.716925Z",
"severity": "low"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010025)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22853)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010025)\n",
"disclosureTime": "2019-07-15T04:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.62117",
"probability": "0.00255"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc6@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547135",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-1010025"
],
"CWE": [
"CWE-330"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-26T02:06:12.573238Z",
"name": "glibc/libc6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-07-24T09:33:59.230537Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-1010025"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K06046097"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853"
},
{
"title": "UBUNTU",
"url": "https://ubuntu.com/security/CVE-2019-1010025"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Use of Insufficiently Random Values",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:53:16.627675Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 9.8,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T17:53:20.558676Z",
"severity": "critical"
}
],
"cvssScore": 9.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010022)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22850)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010022)\n",
"disclosureTime": "2019-07-15T04:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.67160",
"probability": "0.00335"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc6@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547196",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-1010022"
],
"CWE": [
"CWE-119"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-26T02:04:58.132579Z",
"name": "glibc/libc6",
"nvdSeverity": "critical",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-07-24T09:33:32.251091Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-1010022"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22850"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22850%23c3"
},
{
"title": "UBUNTU",
"url": "https://ubuntu.com/security/CVE-2019-1010022"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-Bounds",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:53:21.660641Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-02-09T11:23:31.120244Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-02-09T11:25:01.944790Z",
"severity": "medium"
}
],
"cvssScore": 4.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-4756)\n- [http://cxib.net/stuff/glob-0day.c](http://cxib.net/stuff/glob-0day.c)\n- [http://securityreason.com/achievement_securityalert/89](http://securityreason.com/achievement_securityalert/89)\n- [http://securityreason.com/exploitalert/9223](http://securityreason.com/exploitalert/9223)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=681681)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756)\n",
"disclosureTime": "2011-03-02T20:00:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.79552",
"probability": "0.00824"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc6@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547293",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2010-4756"
],
"CWE": [
"CWE-399"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:43.085188Z",
"name": "glibc/libc6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2011-03-02T20:00:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-4756"
},
{
"title": "http://cxib.net/stuff/glob-0day.c",
"url": "http://cxib.net/stuff/glob-0day.c"
},
{
"title": "http://securityreason.com/achievement_securityalert/89",
"url": "http://securityreason.com/achievement_securityalert/89"
},
{
"title": "http://securityreason.com/exploitalert/9223",
"url": "http://securityreason.com/exploitalert/9223"
},
{
"title": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=681681"
},
{
"title": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Management Errors",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:53:24.764385Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T17:53:36.820375Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.8,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"modificationTime": "2022-11-27T20:32:48.179719Z",
"severity": "high"
}
],
"cvssScore": 8.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010023)\n- [CONFIRM](https://support.f5.com/csp/article/K11932200?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22851)\n- [Security Focus](http://www.securityfocus.com/bid/109167)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010023)\n",
"disclosureTime": "2019-07-15T04:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.82178",
"probability": "0.01070"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"glibc/libc6@2.36-9+deb12u1"
],
"id": "SNYK-DEBIAN12-GLIBC-1547373",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-1010023"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-11-27T20:32:48.179719Z",
"name": "glibc/libc6",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "glibc",
"patches": [],
"publicationTime": "2019-07-24T09:36:38.241516Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-1010023"
},
{
"title": "CONFIRM",
"url": "https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS"
},
{
"title": "MISC",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22851"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/109167"
},
{
"title": "UBUNTU",
"url": "https://ubuntu.com/security/CVE-2019-1010023"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2019-1010023",
"upgradePath": [],
"version": "2.36-9+deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-02-24T00:35:02.015920Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 6.2,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-10-26T01:05:09.249829Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-05-27T01:10:18.011236Z",
"severity": "low"
}
],
"cvssScore": 3.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nGnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.\n## Remediation\nThere is no fixed version for `Debian:12` `gnupg2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-3219)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2022-3219)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2127010)\n- [secalert@redhat.com](https://dev.gnupg.org/D556)\n- [secalert@redhat.com](https://dev.gnupg.org/T5993)\n- [secalert@redhat.com](https://marc.info/?l=oss-security&m=165696590211434&w=4)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230324-0001/)\n",
"disclosureTime": "2023-02-23T20:15:12.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.08370",
"probability": "0.00044"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"gnupg2/gpgv@2.2.40-1.1"
],
"id": "SNYK-DEBIAN12-GNUPG2-3330747",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-3219"
],
"CWE": [
"CWE-787"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-27T01:10:18.044819Z",
"name": "gnupg2/gpgv",
"nvdSeverity": "low",
"packageManager": "debian:12",
"packageName": "gnupg2",
"patches": [],
"publicationTime": "2023-02-24T00:34:45.839506Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-3219"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2022-3219"
},
{
"title": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010"
},
{
"title": "secalert@redhat.com",
"url": "https://dev.gnupg.org/D556"
},
{
"title": "secalert@redhat.com",
"url": "https://dev.gnupg.org/T5993"
},
{
"title": "secalert@redhat.com",
"url": "https://marc.info/?l=oss-security&m=165696590211434&w=4"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20230324-0001/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-bounds Write",
"upgradePath": [],
"version": "2.2.40-1.1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-02-24T00:35:02.015920Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 6.2,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-10-26T01:05:09.249829Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-05-27T01:10:18.011236Z",
"severity": "low"
}
],
"cvssScore": 3.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nGnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.\n## Remediation\nThere is no fixed version for `Debian:12` `gnupg2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-3219)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2022-3219)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2127010)\n- [secalert@redhat.com](https://dev.gnupg.org/D556)\n- [secalert@redhat.com](https://dev.gnupg.org/T5993)\n- [secalert@redhat.com](https://marc.info/?l=oss-security&m=165696590211434&w=4)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230324-0001/)\n",
"disclosureTime": "2023-02-23T20:15:12.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.08370",
"probability": "0.00044"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"gnupg2/gpgv@2.2.40-1.1"
],
"id": "SNYK-DEBIAN12-GNUPG2-3330747",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-3219"
],
"CWE": [
"CWE-787"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-27T01:10:18.044819Z",
"name": "gnupg2/gpgv",
"nvdSeverity": "low",
"packageManager": "debian:12",
"packageName": "gnupg2",
"patches": [],
"publicationTime": "2023-02-24T00:34:45.839506Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-3219"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2022-3219"
},
{
"title": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010"
},
{
"title": "secalert@redhat.com",
"url": "https://dev.gnupg.org/D556"
},
{
"title": "secalert@redhat.com",
"url": "https://dev.gnupg.org/T5993"
},
{
"title": "secalert@redhat.com",
"url": "https://marc.info/?l=oss-security&m=165696590211434&w=4"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20230324-0001/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-bounds Write",
"upgradePath": [],
"version": "2.2.40-1.1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:53:13.601907Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"modificationTime": "2023-02-09T11:23:41.981191Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 3.7,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-05-03T23:39:05.043124Z",
"severity": "low"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"modificationTime": "2023-02-09T11:23:18.530513Z",
"severity": "medium"
}
],
"cvssScore": 4.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.\n## Remediation\nThere is no fixed version for `Debian:12` `gnutls28`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3389)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html)\n- [Apple Security Advisory](http://support.apple.com/kb/HT4999)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5001)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5130)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5281)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5501)\n- [Apple Security Advisory](http://support.apple.com/kb/HT6150)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/May/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html)\n- [CERT](http://www.us-cert.gov/cas/techalerts/TA12-010A.html)\n- [Cert Vulnerability Note](http://www.kb.cert.org/vuls/id/864643)\n- [Chrome Release](http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html)\n- [CONFIRM](http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/)\n- [CONFIRM](http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx)\n- [CONFIRM](http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx)\n- [CONFIRM](http://curl.haxx.se/docs/adv_20120124B.html)\n- [CONFIRM](http://downloads.asterisk.org/pub/security/AST-2016-001.html)\n- [CONFIRM](http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue)\n- [CONFIRM](https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail)\n- [CONFIRM](https://bugzilla.novell.com/show_bug.cgi?id=719047)\n- [CONFIRM](https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf)\n- [CONFIRM](http://technet.microsoft.com/security/advisory/2588513)\n- [CONFIRM](http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf)\n- [CONFIRM](http://www.ibm.com/developerworks/java/jdk/alerts/)\n- [CONFIRM](http://www.imperialviolet.org/2011/09/23/chromeandbeast.html)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1160/)\n- [CONFIRM](http://www.opera.com/support/kb/view/1004/)\n- [Debian Security Advisory](http://www.debian.org/security/2012/dsa-2398)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201203-02.xml)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201406-32.xml)\n- [HP](https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132750579901589&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132872385320240&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133365109612558&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133728004526190&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254866602253&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254957702612&w=2)\n- [MISC](http://ekoparty.org/2011/juliano-rizzo.php)\n- [MISC](http://eprint.iacr.org/2004/111)\n- [MISC](http://eprint.iacr.org/2006/136)\n- [MISC](http://isc.sans.edu/diary/SSL+TLS+part+3+/11635)\n- [MISC](https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02)\n- [MISC](http://vnhacker.blogspot.com/2011/09/beast.html)\n- [MISC](http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html)\n- [MISC](http://www.insecure.cl/Beast-SSL.rar)\n- [MS](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006)\n- [MS](http://technet.microsoft.com/security/bulletin/MS12-006)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html)\n- [OSVDB](http://osvdb.org/74829)\n- [Oval Security](https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=737506)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2012-0508.html)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2013-1455.html)\n- [Secunia Advisory](http://secunia.com/advisories/45791)\n- [Secunia Advisory](http://secunia.com/advisories/47998)\n- [Secunia Advisory](http://secunia.com/advisories/48256)\n- [Secunia Advisory](http://secunia.com/advisories/48692)\n- [Secunia Advisory](http://secunia.com/advisories/48915)\n- [Secunia Advisory](http://secunia.com/advisories/48948)\n- [Secunia Advisory](http://secunia.com/advisories/49198)\n- [Secunia Advisory](http://secunia.com/advisories/55322)\n- [Secunia Advisory](http://secunia.com/advisories/55350)\n- [Secunia Advisory](http://secunia.com/advisories/55351)\n- [Security Focus](http://www.securityfocus.com/bid/49388)\n- [Security Focus](http://www.securityfocus.com/bid/49778)\n- [Security Tracker](http://www.securitytracker.com/id?1025997)\n- [Security Tracker](http://www.securitytracker.com/id?1026103)\n- [Security Tracker](http://www.securitytracker.com/id?1026704)\n- [Security Tracker](http://www.securitytracker.com/id/1029190)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html)\n- [SUSE](https://hermes.opensuse.org/messages/13154861)\n- [SUSE](https://hermes.opensuse.org/messages/13155432)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389)\n- [Ubuntu Security Advisory](http://www.ubuntu.com/usn/USN-1263-1)\n",
"disclosureTime": "2011-09-06T19:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.57824",
"probability": "0.00211"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"gnutls28/libgnutls30@3.7.9-2"
],
"id": "SNYK-DEBIAN12-GNUTLS28-1547121",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2011-3389"
],
"CWE": [
"CWE-20"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:43.062945Z",
"name": "gnutls28/libgnutls30",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gnutls28",
"patches": [],
"publicationTime": "2011-09-06T19:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2011-3389"
},
{
"title": "APPLE",
"url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html"
},
{
"title": "APPLE",
"url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT4999"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5001"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5130"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5281"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5501"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT6150"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html"
},
{
"title": "CERT",
"url": "http://www.us-cert.gov/cas/techalerts/TA12-010A.html"
},
{
"title": "Cert Vulnerability Note",
"url": "http://www.kb.cert.org/vuls/id/864643"
},
{
"title": "Chrome Release",
"url": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html"
},
{
"title": "CONFIRM",
"url": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/"
},
{
"title": "CONFIRM",
"url": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx"
},
{
"title": "CONFIRM",
"url": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx"
},
{
"title": "CONFIRM",
"url": "http://curl.haxx.se/docs/adv_20120124B.html"
},
{
"title": "CONFIRM",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html"
},
{
"title": "CONFIRM",
"url": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue"
},
{
"title": "CONFIRM",
"url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail"
},
{
"title": "CONFIRM",
"url": "https://bugzilla.novell.com/show_bug.cgi?id=719047"
},
{
"title": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
},
{
"title": "CONFIRM",
"url": "http://technet.microsoft.com/security/advisory/2588513"
},
{
"title": "CONFIRM",
"url": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf"
},
{
"title": "CONFIRM",
"url": "http://www.ibm.com/developerworks/java/jdk/alerts/"
},
{
"title": "CONFIRM",
"url": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/mac/1151/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/mac/1160/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/unix/1151/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/unix/1160/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/windows/1151/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/windows/1160/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/support/kb/view/1004/"
},
{
"title": "Debian Security Advisory",
"url": "http://www.debian.org/security/2012/dsa-2398"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201203-02.xml"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
},
{
"title": "HP",
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=132750579901589&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=132872385320240&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=133365109612558&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=133728004526190&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=134254866602253&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=134254957702612&w=2"
},
{
"title": "MISC",
"url": "http://ekoparty.org/2011/juliano-rizzo.php"
},
{
"title": "MISC",
"url": "http://eprint.iacr.org/2004/111"
},
{
"title": "MISC",
"url": "http://eprint.iacr.org/2006/136"
},
{
"title": "MISC",
"url": "http://isc.sans.edu/diary/SSL%2BTLS%2Bpart%2B3%2B/11635"
},
{
"title": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02"
},
{
"title": "MISC",
"url": "http://vnhacker.blogspot.com/2011/09/beast.html"
},
{
"title": "MISC",
"url": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html"
},
{
"title": "MISC",
"url": "http://www.insecure.cl/Beast-SSL.rar"
},
{
"title": "MS",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006"
},
{
"title": "MS",
"url": "http://technet.microsoft.com/security/bulletin/MS12-006"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html"
},
{
"title": "OSVDB",
"url": "http://osvdb.org/74829"
},
{
"title": "Oval Security",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=737506"
},
{
"title": "RedHat Security Advisory",
"url": "http://rhn.redhat.com/errata/RHSA-2012-0508.html"
},
{
"title": "RedHat Security Advisory",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/45791"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/47998"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48256"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48692"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48915"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48948"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/49198"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55322"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55350"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55351"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/49388"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/49778"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id?1025997"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id?1026103"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id?1026704"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id/1029190"
},
{
"title": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html"
},
{
"title": "SUSE",
"url": "https://hermes.opensuse.org/messages/13154861"
},
{
"title": "SUSE",
"url": "https://hermes.opensuse.org/messages/13155432"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389"
},
{
"title": "Ubuntu Security Advisory",
"url": "http://www.ubuntu.com/usn/USN-1263-1"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Input Validation",
"upgradePath": [],
"version": "3.7.9-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:53:13.601907Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"modificationTime": "2023-02-09T11:23:41.981191Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 3.7,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-05-03T23:39:05.043124Z",
"severity": "low"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"modificationTime": "2023-02-09T11:23:18.530513Z",
"severity": "medium"
}
],
"cvssScore": 4.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.\n## Remediation\nThere is no fixed version for `Debian:12` `gnutls28`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3389)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html)\n- [Apple Security Advisory](http://support.apple.com/kb/HT4999)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5001)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5130)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5281)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5501)\n- [Apple Security Advisory](http://support.apple.com/kb/HT6150)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/May/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html)\n- [CERT](http://www.us-cert.gov/cas/techalerts/TA12-010A.html)\n- [Cert Vulnerability Note](http://www.kb.cert.org/vuls/id/864643)\n- [Chrome Release](http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html)\n- [CONFIRM](http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/)\n- [CONFIRM](http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx)\n- [CONFIRM](http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx)\n- [CONFIRM](http://curl.haxx.se/docs/adv_20120124B.html)\n- [CONFIRM](http://downloads.asterisk.org/pub/security/AST-2016-001.html)\n- [CONFIRM](http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue)\n- [CONFIRM](https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail)\n- [CONFIRM](https://bugzilla.novell.com/show_bug.cgi?id=719047)\n- [CONFIRM](https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf)\n- [CONFIRM](http://technet.microsoft.com/security/advisory/2588513)\n- [CONFIRM](http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf)\n- [CONFIRM](http://www.ibm.com/developerworks/java/jdk/alerts/)\n- [CONFIRM](http://www.imperialviolet.org/2011/09/23/chromeandbeast.html)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1160/)\n- [CONFIRM](http://www.opera.com/support/kb/view/1004/)\n- [Debian Security Advisory](http://www.debian.org/security/2012/dsa-2398)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201203-02.xml)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201406-32.xml)\n- [HP](https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132750579901589&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132872385320240&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133365109612558&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133728004526190&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254866602253&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254957702612&w=2)\n- [MISC](http://ekoparty.org/2011/juliano-rizzo.php)\n- [MISC](http://eprint.iacr.org/2004/111)\n- [MISC](http://eprint.iacr.org/2006/136)\n- [MISC](http://isc.sans.edu/diary/SSL+TLS+part+3+/11635)\n- [MISC](https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02)\n- [MISC](http://vnhacker.blogspot.com/2011/09/beast.html)\n- [MISC](http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html)\n- [MISC](http://www.insecure.cl/Beast-SSL.rar)\n- [MS](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006)\n- [MS](http://technet.microsoft.com/security/bulletin/MS12-006)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html)\n- [OSVDB](http://osvdb.org/74829)\n- [Oval Security](https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=737506)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2012-0508.html)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2013-1455.html)\n- [Secunia Advisory](http://secunia.com/advisories/45791)\n- [Secunia Advisory](http://secunia.com/advisories/47998)\n- [Secunia Advisory](http://secunia.com/advisories/48256)\n- [Secunia Advisory](http://secunia.com/advisories/48692)\n- [Secunia Advisory](http://secunia.com/advisories/48915)\n- [Secunia Advisory](http://secunia.com/advisories/48948)\n- [Secunia Advisory](http://secunia.com/advisories/49198)\n- [Secunia Advisory](http://secunia.com/advisories/55322)\n- [Secunia Advisory](http://secunia.com/advisories/55350)\n- [Secunia Advisory](http://secunia.com/advisories/55351)\n- [Security Focus](http://www.securityfocus.com/bid/49388)\n- [Security Focus](http://www.securityfocus.com/bid/49778)\n- [Security Tracker](http://www.securitytracker.com/id?1025997)\n- [Security Tracker](http://www.securitytracker.com/id?1026103)\n- [Security Tracker](http://www.securitytracker.com/id?1026704)\n- [Security Tracker](http://www.securitytracker.com/id/1029190)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html)\n- [SUSE](https://hermes.opensuse.org/messages/13154861)\n- [SUSE](https://hermes.opensuse.org/messages/13155432)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389)\n- [Ubuntu Security Advisory](http://www.ubuntu.com/usn/USN-1263-1)\n",
"disclosureTime": "2011-09-06T19:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.57824",
"probability": "0.00211"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"rtmpdump/librtmp1@2.4+20151223.gitfa8646d.1-2+b2",
"gnutls28/libgnutls30@3.7.9-2"
],
"id": "SNYK-DEBIAN12-GNUTLS28-1547121",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2011-3389"
],
"CWE": [
"CWE-20"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:43.062945Z",
"name": "gnutls28/libgnutls30",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gnutls28",
"patches": [],
"publicationTime": "2011-09-06T19:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2011-3389"
},
{
"title": "APPLE",
"url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html"
},
{
"title": "APPLE",
"url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT4999"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5001"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5130"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5281"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5501"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT6150"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html"
},
{
"title": "CERT",
"url": "http://www.us-cert.gov/cas/techalerts/TA12-010A.html"
},
{
"title": "Cert Vulnerability Note",
"url": "http://www.kb.cert.org/vuls/id/864643"
},
{
"title": "Chrome Release",
"url": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html"
},
{
"title": "CONFIRM",
"url": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/"
},
{
"title": "CONFIRM",
"url": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx"
},
{
"title": "CONFIRM",
"url": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx"
},
{
"title": "CONFIRM",
"url": "http://curl.haxx.se/docs/adv_20120124B.html"
},
{
"title": "CONFIRM",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html"
},
{
"title": "CONFIRM",
"url": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue"
},
{
"title": "CONFIRM",
"url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail"
},
{
"title": "CONFIRM",
"url": "https://bugzilla.novell.com/show_bug.cgi?id=719047"
},
{
"title": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
},
{
"title": "CONFIRM",
"url": "http://technet.microsoft.com/security/advisory/2588513"
},
{
"title": "CONFIRM",
"url": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf"
},
{
"title": "CONFIRM",
"url": "http://www.ibm.com/developerworks/java/jdk/alerts/"
},
{
"title": "CONFIRM",
"url": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/mac/1151/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/mac/1160/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/unix/1151/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/unix/1160/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/windows/1151/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/windows/1160/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/support/kb/view/1004/"
},
{
"title": "Debian Security Advisory",
"url": "http://www.debian.org/security/2012/dsa-2398"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201203-02.xml"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
},
{
"title": "HP",
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=132750579901589&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=132872385320240&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=133365109612558&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=133728004526190&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=134254866602253&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=134254957702612&w=2"
},
{
"title": "MISC",
"url": "http://ekoparty.org/2011/juliano-rizzo.php"
},
{
"title": "MISC",
"url": "http://eprint.iacr.org/2004/111"
},
{
"title": "MISC",
"url": "http://eprint.iacr.org/2006/136"
},
{
"title": "MISC",
"url": "http://isc.sans.edu/diary/SSL%2BTLS%2Bpart%2B3%2B/11635"
},
{
"title": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02"
},
{
"title": "MISC",
"url": "http://vnhacker.blogspot.com/2011/09/beast.html"
},
{
"title": "MISC",
"url": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html"
},
{
"title": "MISC",
"url": "http://www.insecure.cl/Beast-SSL.rar"
},
{
"title": "MS",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006"
},
{
"title": "MS",
"url": "http://technet.microsoft.com/security/bulletin/MS12-006"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html"
},
{
"title": "OSVDB",
"url": "http://osvdb.org/74829"
},
{
"title": "Oval Security",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=737506"
},
{
"title": "RedHat Security Advisory",
"url": "http://rhn.redhat.com/errata/RHSA-2012-0508.html"
},
{
"title": "RedHat Security Advisory",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/45791"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/47998"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48256"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48692"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48915"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48948"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/49198"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55322"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55350"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55351"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/49388"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/49778"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id?1025997"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id?1026103"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id?1026704"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id/1029190"
},
{
"title": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html"
},
{
"title": "SUSE",
"url": "https://hermes.opensuse.org/messages/13154861"
},
{
"title": "SUSE",
"url": "https://hermes.opensuse.org/messages/13155432"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389"
},
{
"title": "Ubuntu Security Advisory",
"url": "http://www.ubuntu.com/usn/USN-1263-1"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Input Validation",
"upgradePath": [],
"version": "3.7.9-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:53:13.601907Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"modificationTime": "2023-02-09T11:23:41.981191Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 3.7,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-05-03T23:39:05.043124Z",
"severity": "low"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"modificationTime": "2023-02-09T11:23:18.530513Z",
"severity": "medium"
}
],
"cvssScore": 4.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.\n## Remediation\nThere is no fixed version for `Debian:12` `gnutls28`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3389)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html)\n- [Apple Security Advisory](http://support.apple.com/kb/HT4999)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5001)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5130)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5281)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5501)\n- [Apple Security Advisory](http://support.apple.com/kb/HT6150)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/May/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html)\n- [CERT](http://www.us-cert.gov/cas/techalerts/TA12-010A.html)\n- [Cert Vulnerability Note](http://www.kb.cert.org/vuls/id/864643)\n- [Chrome Release](http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html)\n- [CONFIRM](http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/)\n- [CONFIRM](http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx)\n- [CONFIRM](http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx)\n- [CONFIRM](http://curl.haxx.se/docs/adv_20120124B.html)\n- [CONFIRM](http://downloads.asterisk.org/pub/security/AST-2016-001.html)\n- [CONFIRM](http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue)\n- [CONFIRM](https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail)\n- [CONFIRM](https://bugzilla.novell.com/show_bug.cgi?id=719047)\n- [CONFIRM](https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf)\n- [CONFIRM](http://technet.microsoft.com/security/advisory/2588513)\n- [CONFIRM](http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf)\n- [CONFIRM](http://www.ibm.com/developerworks/java/jdk/alerts/)\n- [CONFIRM](http://www.imperialviolet.org/2011/09/23/chromeandbeast.html)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1160/)\n- [CONFIRM](http://www.opera.com/support/kb/view/1004/)\n- [Debian Security Advisory](http://www.debian.org/security/2012/dsa-2398)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201203-02.xml)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201406-32.xml)\n- [HP](https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132750579901589&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132872385320240&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133365109612558&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133728004526190&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254866602253&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254957702612&w=2)\n- [MISC](http://ekoparty.org/2011/juliano-rizzo.php)\n- [MISC](http://eprint.iacr.org/2004/111)\n- [MISC](http://eprint.iacr.org/2006/136)\n- [MISC](http://isc.sans.edu/diary/SSL+TLS+part+3+/11635)\n- [MISC](https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02)\n- [MISC](http://vnhacker.blogspot.com/2011/09/beast.html)\n- [MISC](http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html)\n- [MISC](http://www.insecure.cl/Beast-SSL.rar)\n- [MS](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006)\n- [MS](http://technet.microsoft.com/security/bulletin/MS12-006)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html)\n- [OSVDB](http://osvdb.org/74829)\n- [Oval Security](https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=737506)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2012-0508.html)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2013-1455.html)\n- [Secunia Advisory](http://secunia.com/advisories/45791)\n- [Secunia Advisory](http://secunia.com/advisories/47998)\n- [Secunia Advisory](http://secunia.com/advisories/48256)\n- [Secunia Advisory](http://secunia.com/advisories/48692)\n- [Secunia Advisory](http://secunia.com/advisories/48915)\n- [Secunia Advisory](http://secunia.com/advisories/48948)\n- [Secunia Advisory](http://secunia.com/advisories/49198)\n- [Secunia Advisory](http://secunia.com/advisories/55322)\n- [Secunia Advisory](http://secunia.com/advisories/55350)\n- [Secunia Advisory](http://secunia.com/advisories/55351)\n- [Security Focus](http://www.securityfocus.com/bid/49388)\n- [Security Focus](http://www.securityfocus.com/bid/49778)\n- [Security Tracker](http://www.securitytracker.com/id?1025997)\n- [Security Tracker](http://www.securitytracker.com/id?1026103)\n- [Security Tracker](http://www.securitytracker.com/id?1026704)\n- [Security Tracker](http://www.securitytracker.com/id/1029190)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html)\n- [SUSE](https://hermes.opensuse.org/messages/13154861)\n- [SUSE](https://hermes.opensuse.org/messages/13155432)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389)\n- [Ubuntu Security Advisory](http://www.ubuntu.com/usn/USN-1263-1)\n",
"disclosureTime": "2011-09-06T19:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.57824",
"probability": "0.00211"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openldap/libldap-2.5-0@2.5.13+dfsg-5",
"gnutls28/libgnutls30@3.7.9-2"
],
"id": "SNYK-DEBIAN12-GNUTLS28-1547121",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2011-3389"
],
"CWE": [
"CWE-20"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:43.062945Z",
"name": "gnutls28/libgnutls30",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "gnutls28",
"patches": [],
"publicationTime": "2011-09-06T19:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2011-3389"
},
{
"title": "APPLE",
"url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html"
},
{
"title": "APPLE",
"url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT4999"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5001"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5130"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5281"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT5501"
},
{
"title": "Apple Security Advisory",
"url": "http://support.apple.com/kb/HT6150"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html"
},
{
"title": "Apple Security Announcement",
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html"
},
{
"title": "CERT",
"url": "http://www.us-cert.gov/cas/techalerts/TA12-010A.html"
},
{
"title": "Cert Vulnerability Note",
"url": "http://www.kb.cert.org/vuls/id/864643"
},
{
"title": "Chrome Release",
"url": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html"
},
{
"title": "CONFIRM",
"url": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/"
},
{
"title": "CONFIRM",
"url": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx"
},
{
"title": "CONFIRM",
"url": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx"
},
{
"title": "CONFIRM",
"url": "http://curl.haxx.se/docs/adv_20120124B.html"
},
{
"title": "CONFIRM",
"url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html"
},
{
"title": "CONFIRM",
"url": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue"
},
{
"title": "CONFIRM",
"url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail"
},
{
"title": "CONFIRM",
"url": "https://bugzilla.novell.com/show_bug.cgi?id=719047"
},
{
"title": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
},
{
"title": "CONFIRM",
"url": "http://technet.microsoft.com/security/advisory/2588513"
},
{
"title": "CONFIRM",
"url": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf"
},
{
"title": "CONFIRM",
"url": "http://www.ibm.com/developerworks/java/jdk/alerts/"
},
{
"title": "CONFIRM",
"url": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/mac/1151/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/mac/1160/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/unix/1151/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/unix/1160/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/windows/1151/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/docs/changelogs/windows/1160/"
},
{
"title": "CONFIRM",
"url": "http://www.opera.com/support/kb/view/1004/"
},
{
"title": "Debian Security Advisory",
"url": "http://www.debian.org/security/2012/dsa-2398"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201203-02.xml"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
},
{
"title": "HP",
"url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=132750579901589&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=132872385320240&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=133365109612558&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=133728004526190&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=134254866602253&w=2"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=134254957702612&w=2"
},
{
"title": "MISC",
"url": "http://ekoparty.org/2011/juliano-rizzo.php"
},
{
"title": "MISC",
"url": "http://eprint.iacr.org/2004/111"
},
{
"title": "MISC",
"url": "http://eprint.iacr.org/2006/136"
},
{
"title": "MISC",
"url": "http://isc.sans.edu/diary/SSL%2BTLS%2Bpart%2B3%2B/11635"
},
{
"title": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02"
},
{
"title": "MISC",
"url": "http://vnhacker.blogspot.com/2011/09/beast.html"
},
{
"title": "MISC",
"url": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html"
},
{
"title": "MISC",
"url": "http://www.insecure.cl/Beast-SSL.rar"
},
{
"title": "MS",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006"
},
{
"title": "MS",
"url": "http://technet.microsoft.com/security/bulletin/MS12-006"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html"
},
{
"title": "OSVDB",
"url": "http://osvdb.org/74829"
},
{
"title": "Oval Security",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=737506"
},
{
"title": "RedHat Security Advisory",
"url": "http://rhn.redhat.com/errata/RHSA-2012-0508.html"
},
{
"title": "RedHat Security Advisory",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/45791"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/47998"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48256"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48692"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48915"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/48948"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/49198"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55322"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55350"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55351"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/49388"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/49778"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id?1025997"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id?1026103"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id?1026704"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id/1029190"
},
{
"title": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html"
},
{
"title": "SUSE",
"url": "https://hermes.opensuse.org/messages/13154861"
},
{
"title": "SUSE",
"url": "https://hermes.opensuse.org/messages/13155432"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389"
},
{
"title": "Ubuntu Security Advisory",
"url": "http://www.ubuntu.com/usn/USN-1263-1"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Input Validation",
"upgradePath": [],
"version": "3.7.9-2"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:54:30.891546Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-01-03T16:32:46.712021Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"modificationTime": "2022-09-01T15:08:13.560274Z",
"severity": "low"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `jbigkit` package and not the `jbigkit` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.\n## Remediation\nThere is no fixed version for `Debian:12` `jbigkit`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-9937)\n- [MISC](http://bugzilla.maptools.org/show_bug.cgi?id=2707)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Security Focus](http://www.securityfocus.com/bid/99304)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-9937)\n",
"disclosureTime": "2017-06-26T12:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.49433",
"probability": "0.00145"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6",
"jbigkit/libjbig0@2.1-6.1"
],
"id": "SNYK-DEBIAN12-JBIGKIT-1549085",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2017-9937"
],
"CWE": [
"CWE-119"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:22.854729Z",
"name": "jbigkit/libjbig0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "jbigkit",
"patches": [],
"publicationTime": "2017-06-26T12:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2017-9937"
},
{
"title": "MISC",
"url": "http://bugzilla.maptools.org/show_bug.cgi?id=2707"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/99304"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-9937"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-Bounds",
"upgradePath": [],
"version": "2.1-6.1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:54:44.918130Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2022-01-03T16:29:48.950383Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n",
"disclosureTime": "2018-01-16T09:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.37283",
"probability": "0.00090"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5support0@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-1549480",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-5709"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:29.255894Z",
"name": "krb5/libkrb5support0",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2018-01-16T09:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-5709"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709"
},
{
"title": "GitHub Additional Information",
"url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-08T01:07:03.929822Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-16T01:10:59.882525Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-08-17T11:02:12.574963Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.7,
"cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-23T13:44:06.372458Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n",
"disclosureTime": "2023-08-07T19:15:09.840000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43695",
"probability": "0.00111"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5support0@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-5825659",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-36054"
],
"CWE": [
"CWE-824"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-09T01:10:57.894447Z",
"name": "krb5/libkrb5support0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2023-08-08T01:06:33.373942Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-36054",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-36054"
},
{
"title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd",
"url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final"
},
{
"title": "https://web.mit.edu/kerberos/www/advisories/",
"url": "https://web.mit.edu/kerberos/www/advisories/"
},
{
"title": "https://security.netapp.com/advisory/ntap-20230908-0004/",
"url": "https://security.netapp.com/advisory/ntap-20230908-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access of Uninitialized Pointer",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:54:44.918130Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2022-01-03T16:29:48.950383Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n",
"disclosureTime": "2018-01-16T09:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.37283",
"probability": "0.00090"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libk5crypto3@1.20.1-2",
"krb5/libkrb5support0@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-1549480",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-5709"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:29.255894Z",
"name": "krb5/libkrb5support0",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2018-01-16T09:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-5709"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709"
},
{
"title": "GitHub Additional Information",
"url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-08T01:07:03.929822Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-16T01:10:59.882525Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-08-17T11:02:12.574963Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.7,
"cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-23T13:44:06.372458Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n",
"disclosureTime": "2023-08-07T19:15:09.840000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43695",
"probability": "0.00111"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libk5crypto3@1.20.1-2",
"krb5/libkrb5support0@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-5825659",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-36054"
],
"CWE": [
"CWE-824"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-09T01:10:57.894447Z",
"name": "krb5/libkrb5support0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2023-08-08T01:06:33.373942Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-36054",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-36054"
},
{
"title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd",
"url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final"
},
{
"title": "https://web.mit.edu/kerberos/www/advisories/",
"url": "https://web.mit.edu/kerberos/www/advisories/"
},
{
"title": "https://security.netapp.com/advisory/ntap-20230908-0004/",
"url": "https://security.netapp.com/advisory/ntap-20230908-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access of Uninitialized Pointer",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:54:44.918130Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2022-01-03T16:29:48.950383Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n",
"disclosureTime": "2018-01-16T09:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.37283",
"probability": "0.00090"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2",
"krb5/libkrb5support0@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-1549480",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-5709"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:29.255894Z",
"name": "krb5/libkrb5support0",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2018-01-16T09:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-5709"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709"
},
{
"title": "GitHub Additional Information",
"url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-08T01:07:03.929822Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-16T01:10:59.882525Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-08-17T11:02:12.574963Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.7,
"cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-23T13:44:06.372458Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n",
"disclosureTime": "2023-08-07T19:15:09.840000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43695",
"probability": "0.00111"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2",
"krb5/libkrb5support0@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-5825659",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-36054"
],
"CWE": [
"CWE-824"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-09T01:10:57.894447Z",
"name": "krb5/libkrb5support0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2023-08-08T01:06:33.373942Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-36054",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-36054"
},
{
"title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd",
"url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final"
},
{
"title": "https://web.mit.edu/kerberos/www/advisories/",
"url": "https://web.mit.edu/kerberos/www/advisories/"
},
{
"title": "https://security.netapp.com/advisory/ntap-20230908-0004/",
"url": "https://security.netapp.com/advisory/ntap-20230908-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access of Uninitialized Pointer",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:54:44.918130Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2022-01-03T16:29:48.950383Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n",
"disclosureTime": "2018-01-16T09:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.37283",
"probability": "0.00090"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libk5crypto3@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-1549480",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-5709"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:29.255894Z",
"name": "krb5/libk5crypto3",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2018-01-16T09:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-5709"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709"
},
{
"title": "GitHub Additional Information",
"url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-08T01:07:03.929822Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-16T01:10:59.882525Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-08-17T11:02:12.574963Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.7,
"cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-23T13:44:06.372458Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n",
"disclosureTime": "2023-08-07T19:15:09.840000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43695",
"probability": "0.00111"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libk5crypto3@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-5825659",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-36054"
],
"CWE": [
"CWE-824"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-09T01:10:57.894447Z",
"name": "krb5/libk5crypto3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2023-08-08T01:06:33.373942Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-36054",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-36054"
},
{
"title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd",
"url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final"
},
{
"title": "https://web.mit.edu/kerberos/www/advisories/",
"url": "https://web.mit.edu/kerberos/www/advisories/"
},
{
"title": "https://security.netapp.com/advisory/ntap-20230908-0004/",
"url": "https://security.netapp.com/advisory/ntap-20230908-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access of Uninitialized Pointer",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:54:44.918130Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2022-01-03T16:29:48.950383Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n",
"disclosureTime": "2018-01-16T09:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.37283",
"probability": "0.00090"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2",
"krb5/libk5crypto3@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-1549480",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-5709"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:29.255894Z",
"name": "krb5/libk5crypto3",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2018-01-16T09:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-5709"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709"
},
{
"title": "GitHub Additional Information",
"url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-08T01:07:03.929822Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-16T01:10:59.882525Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-08-17T11:02:12.574963Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.7,
"cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-23T13:44:06.372458Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n",
"disclosureTime": "2023-08-07T19:15:09.840000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43695",
"probability": "0.00111"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2",
"krb5/libk5crypto3@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-5825659",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-36054"
],
"CWE": [
"CWE-824"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-09T01:10:57.894447Z",
"name": "krb5/libk5crypto3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2023-08-08T01:06:33.373942Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-36054",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-36054"
},
{
"title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd",
"url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final"
},
{
"title": "https://web.mit.edu/kerberos/www/advisories/",
"url": "https://web.mit.edu/kerberos/www/advisories/"
},
{
"title": "https://security.netapp.com/advisory/ntap-20230908-0004/",
"url": "https://security.netapp.com/advisory/ntap-20230908-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access of Uninitialized Pointer",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:54:44.918130Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2022-01-03T16:29:48.950383Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n",
"disclosureTime": "2018-01-16T09:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.37283",
"probability": "0.00090"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-1549480",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-5709"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:29.255894Z",
"name": "krb5/libkrb5-3",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2018-01-16T09:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-5709"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709"
},
{
"title": "GitHub Additional Information",
"url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-08T01:07:03.929822Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-16T01:10:59.882525Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-08-17T11:02:12.574963Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.7,
"cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-23T13:44:06.372458Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n",
"disclosureTime": "2023-08-07T19:15:09.840000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43695",
"probability": "0.00111"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-5825659",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-36054"
],
"CWE": [
"CWE-824"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-09T01:10:57.894447Z",
"name": "krb5/libkrb5-3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2023-08-08T01:06:33.373942Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-36054",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-36054"
},
{
"title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd",
"url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final"
},
{
"title": "https://web.mit.edu/kerberos/www/advisories/",
"url": "https://web.mit.edu/kerberos/www/advisories/"
},
{
"title": "https://security.netapp.com/advisory/ntap-20230908-0004/",
"url": "https://security.netapp.com/advisory/ntap-20230908-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access of Uninitialized Pointer",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:54:44.918130Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2022-01-03T16:29:48.950383Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n",
"disclosureTime": "2018-01-16T09:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.37283",
"probability": "0.00090"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-1549480",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-5709"
],
"CWE": [
"CWE-190"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:29.255894Z",
"name": "krb5/libgssapi-krb5-2",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2018-01-16T09:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-5709"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709"
},
{
"title": "GitHub Additional Information",
"url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Integer Overflow or Wraparound",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-08T01:07:03.929822Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-16T01:10:59.882525Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-08-17T11:02:12.574963Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.7,
"cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-23T13:44:06.372458Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n",
"disclosureTime": "2023-08-07T19:15:09.840000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43695",
"probability": "0.00111"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2"
],
"id": "SNYK-DEBIAN12-KRB5-5825659",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-36054"
],
"CWE": [
"CWE-824"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-09T01:10:57.894447Z",
"name": "krb5/libgssapi-krb5-2",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "krb5",
"patches": [],
"publicationTime": "2023-08-08T01:06:33.373942Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-36054",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-36054"
},
{
"title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd",
"url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final"
},
{
"title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final",
"url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final"
},
{
"title": "https://web.mit.edu/kerberos/www/advisories/",
"url": "https://web.mit.edu/kerberos/www/advisories/"
},
{
"title": "https://security.netapp.com/advisory/ntap-20230908-0004/",
"url": "https://security.netapp.com/advisory/ntap-20230908-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access of Uninitialized Pointer",
"upgradePath": [],
"version": "1.20.1-2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2023-03-16T00:48:43.187167Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"modificationTime": "2023-03-18T01:10:14.985127Z",
"severity": "high"
}
],
"cvssScore": 8.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libde265` package and not the `libde265` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc.\n## Remediation\nThere is no fixed version for `Debian:12` `libde265`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-27103)\n- [cve@mitre.org](https://github.com/strukturag/libde265/issues/394)\n",
"disclosureTime": "2023-03-15T15:15:09.670000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.36047",
"probability": "0.00087"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libheif/libheif1@1.15.1-1",
"libde265/libde265-0@1.0.11-1"
],
"id": "SNYK-DEBIAN12-LIBDE265-3361563",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-27103"
],
"CWE": [
"CWE-787"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-24T00:46:32.091965Z",
"name": "libde265/libde265-0",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "libde265",
"patches": [],
"publicationTime": "2023-03-16T00:48:43.153153Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-27103"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/strukturag/libde265/issues/394"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-bounds Write",
"upgradePath": [],
"version": "1.0.11-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-03-16T00:49:53.520020Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-03-21T01:10:09.465225Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libde265` package and not the `libde265` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx.cc.\n## Remediation\nThere is no fixed version for `Debian:12` `libde265`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-27102)\n- [cve@mitre.org](https://github.com/strukturag/libde265/issues/393)\n",
"disclosureTime": "2023-03-15T15:15:09.617000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.14013",
"probability": "0.00046"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libheif/libheif1@1.15.1-1",
"libde265/libde265-0@1.0.11-1"
],
"id": "SNYK-DEBIAN12-LIBDE265-3361567",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-27102"
],
"CWE": [
"CWE-476"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-24T00:46:19.394399Z",
"name": "libde265/libde265-0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "libde265",
"patches": [],
"publicationTime": "2023-03-16T00:48:48.784025Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-27102"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/strukturag/libde265/issues/393"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "NULL Pointer Dereference",
"upgradePath": [],
"version": "1.0.11-1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:55:11.810107Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-09-01T21:30:15.963323Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-01-03T16:30:47.839471Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libgcrypt20` package and not the `libgcrypt20` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.\n## Remediation\nThere is no fixed version for `Debian:12` `libgcrypt20`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-6829)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki)\n- [MISC](https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html)\n- [MISC](https://www.oracle.com/security-alerts/cpujan2020.html)\n",
"disclosureTime": "2018-02-07T23:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.55484",
"probability": "0.00191"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"libgcrypt20@1.10.1-3"
],
"id": "SNYK-DEBIAN12-LIBGCRYPT20-1550206",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-6829"
],
"CWE": [
"CWE-327"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:28.786599Z",
"name": "libgcrypt20",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "libgcrypt20",
"patches": [],
"publicationTime": "2018-02-07T23:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-6829"
},
{
"title": "MISC",
"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal"
},
{
"title": "MISC",
"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki"
},
{
"title": "MISC",
"url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html"
},
{
"title": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Use of a Broken or Risky Cryptographic Algorithm",
"upgradePath": [],
"version": "1.10.1-3"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:55:11.810107Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-09-01T21:30:15.963323Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-01-03T16:30:47.839471Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libgcrypt20` package and not the `libgcrypt20` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.\n## Remediation\nThere is no fixed version for `Debian:12` `libgcrypt20`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-6829)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki)\n- [MISC](https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html)\n- [MISC](https://www.oracle.com/security-alerts/cpujan2020.html)\n",
"disclosureTime": "2018-02-07T23:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.55484",
"probability": "0.00191"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"gnupg2/gpgv@2.2.40-1.1",
"libgcrypt20@1.10.1-3"
],
"id": "SNYK-DEBIAN12-LIBGCRYPT20-1550206",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-6829"
],
"CWE": [
"CWE-327"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:28.786599Z",
"name": "libgcrypt20",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "libgcrypt20",
"patches": [],
"publicationTime": "2018-02-07T23:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-6829"
},
{
"title": "MISC",
"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal"
},
{
"title": "MISC",
"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki"
},
{
"title": "MISC",
"url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html"
},
{
"title": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Use of a Broken or Risky Cryptographic Algorithm",
"upgradePath": [],
"version": "1.10.1-3"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:55:11.810107Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-09-01T21:30:15.963323Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-01-03T16:30:47.839471Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libgcrypt20` package and not the `libgcrypt20` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.\n## Remediation\nThere is no fixed version for `Debian:12` `libgcrypt20`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-6829)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki)\n- [MISC](https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html)\n- [MISC](https://www.oracle.com/security-alerts/cpujan2020.html)\n",
"disclosureTime": "2018-02-07T23:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.55484",
"probability": "0.00191"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-xslt@1.25.2-1~bookworm",
"libxslt/libxslt1.1@1.1.35-1",
"libgcrypt20@1.10.1-3"
],
"id": "SNYK-DEBIAN12-LIBGCRYPT20-1550206",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-6829"
],
"CWE": [
"CWE-327"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:28.786599Z",
"name": "libgcrypt20",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "libgcrypt20",
"patches": [],
"publicationTime": "2018-02-07T23:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-6829"
},
{
"title": "MISC",
"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal"
},
{
"title": "MISC",
"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki"
},
{
"title": "MISC",
"url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html"
},
{
"title": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Use of a Broken or Risky Cryptographic Algorithm",
"upgradePath": [],
"version": "1.10.1-3"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:55:11.810107Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-09-01T21:30:15.963323Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-01-03T16:30:47.839471Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libgcrypt20` package and not the `libgcrypt20` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.\n## Remediation\nThere is no fixed version for `Debian:12` `libgcrypt20`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-6829)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki)\n- [MISC](https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html)\n- [MISC](https://www.oracle.com/security-alerts/cpujan2020.html)\n",
"disclosureTime": "2018-02-07T23:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.55484",
"probability": "0.00191"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"systemd/libsystemd0@252.12-1~deb12u1",
"libgcrypt20@1.10.1-3"
],
"id": "SNYK-DEBIAN12-LIBGCRYPT20-1550206",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-6829"
],
"CWE": [
"CWE-327"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:28.786599Z",
"name": "libgcrypt20",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "libgcrypt20",
"patches": [],
"publicationTime": "2018-02-07T23:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-6829"
},
{
"title": "MISC",
"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal"
},
{
"title": "MISC",
"url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki"
},
{
"title": "MISC",
"url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html"
},
{
"title": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Use of a Broken or Risky Cryptographic Algorithm",
"upgradePath": [],
"version": "1.10.1-3"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-05-06T12:50:25.956095Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-05-12T01:10:17.979784Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-05-17T11:01:57.348399Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libheif` package and not the `libheif` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `libheif`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-29659)\n- [cve@mitre.org](https://github.com/strukturag/libheif/issues/794)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L/)\n",
"disclosureTime": "2023-05-05T16:15:09.387000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.15557",
"probability": "0.00049"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libheif/libheif1@1.15.1-1"
],
"id": "SNYK-DEBIAN12-LIBHEIF-5498469",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-29659"
],
"CWE": [
"CWE-369"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-24T00:46:24.190029Z",
"name": "libheif/libheif1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "libheif",
"patches": [],
"publicationTime": "2023-05-06T12:49:49.736256Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-29659"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/strukturag/libheif/issues/794"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Divide By Zero",
"upgradePath": [],
"version": "1.15.1-1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-01-26T14:01:16.081543Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-09-01T22:16:05.689251Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-08T13:10:48.367003Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libpng1.6` package and not the `libpng1.6` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `libpng1.6`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2021-4214)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2043393)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2021-4214)\n- [secalert@redhat.com](https://github.com/glennrp/libpng/issues/302)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20221020-0001/)\n",
"disclosureTime": "2022-08-24T16:15:10.037000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libpng1.6/libpng16-16@1.6.39-2"
],
"id": "SNYK-DEBIAN12-LIBPNG16-2363910",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2021-4214"
],
"CWE": [
"CWE-120"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:39:16.431777Z",
"name": "libpng1.6/libpng16-16",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "libpng1.6",
"patches": [],
"publicationTime": "2022-01-26T14:01:16.064630Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2021-4214"
},
{
"title": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2043393"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2021-4214"
},
{
"title": "secalert@redhat.com",
"url": "https://github.com/glennrp/libpng/issues/302"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20221020-0001/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Buffer Overflow",
"upgradePath": [],
"version": "1.6.39-2"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-01-26T14:01:16.081543Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-09-01T22:16:05.689251Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-08T13:10:48.367003Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libpng1.6` package and not the `libpng1.6` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `libpng1.6`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2021-4214)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2043393)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2021-4214)\n- [secalert@redhat.com](https://github.com/glennrp/libpng/issues/302)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20221020-0001/)\n",
"disclosureTime": "2022-08-24T16:15:10.037000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"fontconfig/libfontconfig1@2.14.1-4",
"freetype/libfreetype6@2.12.1+dfsg-5",
"libpng1.6/libpng16-16@1.6.39-2"
],
"id": "SNYK-DEBIAN12-LIBPNG16-2363910",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2021-4214"
],
"CWE": [
"CWE-120"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:39:16.431777Z",
"name": "libpng1.6/libpng16-16",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "libpng1.6",
"patches": [],
"publicationTime": "2022-01-26T14:01:16.064630Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2021-4214"
},
{
"title": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2043393"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2021-4214"
},
{
"title": "secalert@redhat.com",
"url": "https://github.com/glennrp/libpng/issues/302"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20221020-0001/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Buffer Overflow",
"upgradePath": [],
"version": "1.6.39-2"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-09-13T01:35:18.712992Z",
"credit": [
""
],
"cvssDetails": [],
"cvssScore": null,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libwebp` package and not the `libwebp` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nHeap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)\n## Remediation\nThere is no fixed version for `Debian:12` `libwebp`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4863)\n- [chrome-cve-admin@google.com](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html)\n- [chrome-cve-admin@google.com](https://crbug.com/1479274)\n",
"disclosureTime": "2023-09-12T15:15:24.327000Z",
"epssDetails": null,
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"libwebp/libwebp7@1.2.4-0.2"
],
"id": "SNYK-DEBIAN12-LIBWEBP-5893095",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-4863"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-13T01:35:18.713030Z",
"name": "libwebp/libwebp7",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "libwebp",
"patches": [],
"publicationTime": "2023-09-12T12:27:16.594261Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-4863",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-4863"
},
{
"title": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html",
"url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html"
},
{
"title": "https://crbug.com/1479274",
"url": "https://crbug.com/1479274"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-4863",
"upgradePath": [],
"version": "1.2.4-0.2"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-09-13T01:35:18.712992Z",
"credit": [
""
],
"cvssDetails": [],
"cvssScore": null,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libwebp` package and not the `libwebp` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nHeap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)\n## Remediation\nThere is no fixed version for `Debian:12` `libwebp`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4863)\n- [chrome-cve-admin@google.com](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html)\n- [chrome-cve-admin@google.com](https://crbug.com/1479274)\n",
"disclosureTime": "2023-09-12T15:15:24.327000Z",
"epssDetails": null,
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6",
"libwebp/libwebp7@1.2.4-0.2"
],
"id": "SNYK-DEBIAN12-LIBWEBP-5893095",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-4863"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-13T01:35:18.713030Z",
"name": "libwebp/libwebp7",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "libwebp",
"patches": [],
"publicationTime": "2023-09-12T12:27:16.594261Z",
"references": [
{
"title": "https://security-tracker.debian.org/tracker/CVE-2023-4863",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-4863"
},
{
"title": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html",
"url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html"
},
{
"title": "https://crbug.com/1479274",
"url": "https://crbug.com/1479274"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-4863",
"upgradePath": [],
"version": "1.2.4-0.2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-30T13:16:28.527232Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-09-01T01:11:04.392367Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxml2` package and not the `libxml2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nXmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.\n## Remediation\nThere is no fixed version for `Debian:12` `libxml2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39615)\n- [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/535)\n",
"disclosureTime": "2023-08-29T17:15:12.527000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.23726",
"probability": "0.00061"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-njs@1.25.2+0.8.0-1~bookworm",
"libxml2@2.9.14+dfsg-1.3~deb12u1"
],
"id": "SNYK-DEBIAN12-LIBXML2-5871333",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-39615"
],
"CWE": [
"CWE-119"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-01T01:18:59.773572Z",
"name": "libxml2",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "libxml2",
"patches": [],
"publicationTime": "2023-08-30T13:15:54.913292Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-39615"
},
{
"title": "cve@mitre.org",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/535"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-Bounds",
"upgradePath": [],
"version": "2.9.14+dfsg-1.3~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-30T13:16:28.527232Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-09-01T01:11:04.392367Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxml2` package and not the `libxml2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nXmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.\n## Remediation\nThere is no fixed version for `Debian:12` `libxml2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39615)\n- [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/535)\n",
"disclosureTime": "2023-08-29T17:15:12.527000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.23726",
"probability": "0.00061"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-xslt@1.25.2-1~bookworm",
"libxml2@2.9.14+dfsg-1.3~deb12u1"
],
"id": "SNYK-DEBIAN12-LIBXML2-5871333",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-39615"
],
"CWE": [
"CWE-119"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-01T01:18:59.773572Z",
"name": "libxml2",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "libxml2",
"patches": [],
"publicationTime": "2023-08-30T13:15:54.913292Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-39615"
},
{
"title": "cve@mitre.org",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/535"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-Bounds",
"upgradePath": [],
"version": "2.9.14+dfsg-1.3~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-08-30T13:16:28.527232Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-09-01T01:11:04.392367Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxml2` package and not the `libxml2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nXmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.\n## Remediation\nThere is no fixed version for `Debian:12` `libxml2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39615)\n- [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/535)\n",
"disclosureTime": "2023-08-29T17:15:12.527000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.23726",
"probability": "0.00061"
},
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-xslt@1.25.2-1~bookworm",
"libxslt/libxslt1.1@1.1.35-1",
"libxml2@2.9.14+dfsg-1.3~deb12u1"
],
"id": "SNYK-DEBIAN12-LIBXML2-5871333",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-39615"
],
"CWE": [
"CWE-119"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-01T01:18:59.773572Z",
"name": "libxml2",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "libxml2",
"patches": [],
"publicationTime": "2023-08-30T13:15:54.913292Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-39615"
},
{
"title": "cve@mitre.org",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/535"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-Bounds",
"upgradePath": [],
"version": "2.9.14+dfsg-1.3~deb12u1"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:55:50.232557Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"modificationTime": "2022-01-03T17:48:23.055640Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"modificationTime": "2022-09-01T14:07:16.538563Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxslt` package and not the `libxslt` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.\n## Remediation\nThere is no fixed version for `Debian:12` `libxslt`.\n## References\n- [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2015-9019)\n- [https://bugzilla.gnome.org/show_bug.cgi?id=758400](https://bugzilla.gnome.org/show_bug.cgi?id=758400)\n- [https://bugzilla.suse.com/show_bug.cgi?id=934119](https://bugzilla.suse.com/show_bug.cgi?id=934119)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-9019)\n",
"disclosureTime": "2017-04-05T21:59:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.23501",
"probability": "0.00060"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-xslt@1.25.2-1~bookworm",
"libxslt/libxslt1.1@1.1.35-1"
],
"id": "SNYK-DEBIAN12-LIBXSLT-1551290",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2015-9019"
],
"CWE": [
"CWE-330"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:22.185766Z",
"name": "libxslt/libxslt1.1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "libxslt",
"patches": [],
"publicationTime": "2017-04-05T21:59:00Z",
"references": [
{
"title": "Debian Security Tracker",
"url": "https://security-tracker.debian.org/tracker/CVE-2015-9019"
},
{
"title": "https://bugzilla.gnome.org/show_bug.cgi?id=758400",
"url": "https://bugzilla.gnome.org/show_bug.cgi?id=758400"
},
{
"title": "https://bugzilla.suse.com/show_bug.cgi?id=934119",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=934119"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-9019"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Use of Insufficiently Random Values",
"upgradePath": [],
"version": "1.1.35-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:57:51.371636Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.803353Z",
"severity": "medium"
}
],
"cvssScore": 6.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n",
"disclosureTime": "2010-01-13T20:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.76795",
"probability": "0.00662"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1554675",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2009-4487"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:39.297372Z",
"name": "nginx",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2010-01-13T20:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2009-4487"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded"
},
{
"title": "MISC",
"url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/37711"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2009-4487",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:58:04.469498Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.620032Z",
"severity": "high"
}
],
"cvssScore": 7.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n",
"disclosureTime": "2013-10-27T00:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.55777",
"probability": "0.00192"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1555042",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-0337"
],
"CWE": [
"CWE-264"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-03-16T13:13:06.615055Z",
"name": "nginx",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2013-10-27T00:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0337"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201310-04.xml"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/21/15"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/22/1"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/24/1"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55181"
}
],
"relativeImportance": "low",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access Restriction Bypass",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:57:51.371636Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.803353Z",
"severity": "medium"
}
],
"cvssScore": 6.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n",
"disclosureTime": "2010-01-13T20:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.76795",
"probability": "0.00662"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-geoip@1.25.2-1~bookworm",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1554675",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2009-4487"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:39.297372Z",
"name": "nginx",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2010-01-13T20:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2009-4487"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded"
},
{
"title": "MISC",
"url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/37711"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2009-4487",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:58:04.469498Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.620032Z",
"severity": "high"
}
],
"cvssScore": 7.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n",
"disclosureTime": "2013-10-27T00:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.55777",
"probability": "0.00192"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-geoip@1.25.2-1~bookworm",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1555042",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-0337"
],
"CWE": [
"CWE-264"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-03-16T13:13:06.615055Z",
"name": "nginx",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2013-10-27T00:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0337"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201310-04.xml"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/21/15"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/22/1"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/24/1"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55181"
}
],
"relativeImportance": "low",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access Restriction Bypass",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:57:51.371636Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.803353Z",
"severity": "medium"
}
],
"cvssScore": 6.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n",
"disclosureTime": "2010-01-13T20:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.76795",
"probability": "0.00662"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1554675",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2009-4487"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:39.297372Z",
"name": "nginx",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2010-01-13T20:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2009-4487"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded"
},
{
"title": "MISC",
"url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/37711"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2009-4487",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:58:04.469498Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.620032Z",
"severity": "high"
}
],
"cvssScore": 7.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n",
"disclosureTime": "2013-10-27T00:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.55777",
"probability": "0.00192"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1555042",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-0337"
],
"CWE": [
"CWE-264"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-03-16T13:13:06.615055Z",
"name": "nginx",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2013-10-27T00:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0337"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201310-04.xml"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/21/15"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/22/1"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/24/1"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55181"
}
],
"relativeImportance": "low",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access Restriction Bypass",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:57:51.371636Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.803353Z",
"severity": "medium"
}
],
"cvssScore": 6.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n",
"disclosureTime": "2010-01-13T20:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.76795",
"probability": "0.00662"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-njs@1.25.2+0.8.0-1~bookworm",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1554675",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2009-4487"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:39.297372Z",
"name": "nginx",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2010-01-13T20:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2009-4487"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded"
},
{
"title": "MISC",
"url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/37711"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2009-4487",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:58:04.469498Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.620032Z",
"severity": "high"
}
],
"cvssScore": 7.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n",
"disclosureTime": "2013-10-27T00:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.55777",
"probability": "0.00192"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-njs@1.25.2+0.8.0-1~bookworm",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1555042",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-0337"
],
"CWE": [
"CWE-264"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-03-16T13:13:06.615055Z",
"name": "nginx",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2013-10-27T00:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0337"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201310-04.xml"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/21/15"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/22/1"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/24/1"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55181"
}
],
"relativeImportance": "low",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access Restriction Bypass",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:57:51.371636Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.803353Z",
"severity": "medium"
}
],
"cvssScore": 6.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n",
"disclosureTime": "2010-01-13T20:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.76795",
"probability": "0.00662"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-xslt@1.25.2-1~bookworm",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1554675",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2009-4487"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:39.297372Z",
"name": "nginx",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2010-01-13T20:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2009-4487"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded"
},
{
"title": "MISC",
"url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/37711"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2009-4487",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cpes": [],
"creationTime": "2021-08-15T06:58:04.469498Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"modificationTime": "2023-02-09T11:24:34.620032Z",
"severity": "high"
}
],
"cvssScore": 7.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n",
"disclosureTime": "2013-10-27T00:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.55777",
"probability": "0.00192"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-xslt@1.25.2-1~bookworm",
"nginx@1.25.2-1~bookworm"
],
"id": "SNYK-DEBIAN12-NGINX-1555042",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-0337"
],
"CWE": [
"CWE-264"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-03-16T13:13:06.615055Z",
"name": "nginx",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "nginx",
"patches": [],
"publicationTime": "2013-10-27T00:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0337"
},
{
"title": "Gentoo Security Advisory",
"url": "http://security.gentoo.org/glsa/glsa-201310-04.xml"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/21/15"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/22/1"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/02/24/1"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/55181"
}
],
"relativeImportance": "low",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access Restriction Bypass",
"upgradePath": [],
"version": "1.25.2-1~bookworm"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:58:26.416725Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.7,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-06-14T01:10:55.829010Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-09-01T20:47:11.884186Z",
"severity": "medium"
}
],
"cvssScore": 4.7,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nslapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-14159)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14159)\n- [MISC](http://www.openldap.org/its/index.cgi?findid=8703)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-14159)\n- [cve@mitre.org](https://www.oracle.com/security-alerts/cpuapr2022.html)\n",
"disclosureTime": "2017-09-05T18:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07859",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openldap/libldap-2.5-0@2.5.13+dfsg-5"
],
"id": "SNYK-DEBIAN12-OPENLDAP-1555631",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2017-14159"
],
"CWE": [
"CWE-665"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T14:06:15.016689Z",
"name": "openldap/libldap-2.5-0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openldap",
"patches": [],
"publicationTime": "2017-09-05T18:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2017-14159"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14159"
},
{
"title": "MISC",
"url": "http://www.openldap.org/its/index.cgi?findid=8703"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-14159"
},
{
"title": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Initialization",
"upgradePath": [],
"version": "2.5.13+dfsg-5"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2021-08-15T06:58:29.662198Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-06-14T01:10:53.087460Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-09-01T20:53:03.150085Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-05-04T00:09:08.207615Z",
"severity": "medium"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncontrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-17740)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17740)\n- [MISC](http://www.openldap.org/its/index.cgi/Incoming?id=8759)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html)\n- [cve@mitre.org](https://kc.mcafee.com/corporate/index?page=content&id=SB10365)\n- [cve@mitre.org](https://www.oracle.com/security-alerts/cpuapr2022.html)\n",
"disclosureTime": "2017-12-18T06:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.70157",
"probability": "0.00407"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openldap/libldap-2.5-0@2.5.13+dfsg-5"
],
"id": "SNYK-DEBIAN12-OPENLDAP-1555724",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2017-17740"
],
"CWE": [
"CWE-119"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T14:07:38.956852Z",
"name": "openldap/libldap-2.5-0",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "openldap",
"patches": [],
"publicationTime": "2017-12-18T06:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2017-17740"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17740"
},
{
"title": "MISC",
"url": "http://www.openldap.org/its/index.cgi/Incoming?id=8759"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html"
},
{
"title": "cve@mitre.org",
"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10365"
},
{
"title": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-Bounds",
"upgradePath": [],
"version": "2.5.13+dfsg-5"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:38.494586Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.2,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2022-05-13T01:11:01.289386Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 4.2,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2022-05-03T23:05:21.716502Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.2,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2022-09-01T15:57:53.712715Z",
"severity": "medium"
}
],
"cvssScore": 4.2,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2020-15719)\n- [MISC](https://access.redhat.com/errata/RHBA-2019:3674)\n- [MISC](https://bugs.openldap.org/show_bug.cgi?id=9266)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=1740070)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html)\n- [cve@mitre.org](https://kc.mcafee.com/corporate/index?page=content&id=SB10365)\n- [cve@mitre.org](https://www.oracle.com/security-alerts/cpuapr2022.html)\n",
"disclosureTime": "2020-07-14T14:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.50812",
"probability": "0.00155"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openldap/libldap-2.5-0@2.5.13+dfsg-5"
],
"id": "SNYK-DEBIAN12-OPENLDAP-1555918",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2020-15719"
],
"CWE": [
"CWE-295"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:46:38.760074Z",
"name": "openldap/libldap-2.5-0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openldap",
"patches": [],
"publicationTime": "2020-07-16T10:54:51.796172Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2020-15719"
},
{
"title": "MISC",
"url": "https://access.redhat.com/errata/RHBA-2019:3674"
},
{
"title": "MISC",
"url": "https://bugs.openldap.org/show_bug.cgi?id=9266"
},
{
"title": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1740070"
},
{
"title": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html"
},
{
"title": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html"
},
{
"title": "cve@mitre.org",
"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10365"
},
{
"title": "cve@mitre.org",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Certificate Validation",
"upgradePath": [],
"version": "2.5.13+dfsg-5"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:39.325104Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"modificationTime": "2023-02-09T11:24:56.007448Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2023-04-29T01:10:07.535565Z",
"severity": "high"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2015-3276)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1238322)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2015-2131.html)\n- [Security Tracker](http://www.securitytracker.com/id/1034221)\n- [secalert@redhat.com](https://access.redhat.com/errata/RHSA-2015:2131)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2015-3276)\n",
"disclosureTime": "2015-12-07T20:59:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.63219",
"probability": "0.00271"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openldap/libldap-2.5-0@2.5.13+dfsg-5"
],
"id": "SNYK-DEBIAN12-OPENLDAP-1555941",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2015-3276"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-04-29T01:10:07.535565Z",
"name": "openldap/libldap-2.5-0",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "openldap",
"patches": [],
"publicationTime": "2015-12-07T20:59:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2015-3276"
},
{
"title": "Oracle Security Bulletin",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1238322"
},
{
"title": "RedHat Security Advisory",
"url": "http://rhn.redhat.com/errata/RHSA-2015-2131.html"
},
{
"title": "Security Tracker",
"url": "http://www.securitytracker.com/id/1034221"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/errata/RHSA-2015:2131"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2015-3276"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "2.5.13+dfsg-5"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-05-30T13:15:51.722655Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.1,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"modificationTime": "2023-06-20T13:42:33.283208Z",
"severity": "high"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-06-07T01:10:13.825709Z",
"severity": "high"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-06-13T11:03:11.422027Z",
"severity": "medium"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2953)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-2953)\n- [secalert@redhat.com](https://bugs.openldap.org/show_bug.cgi?id=9904)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230703-0005/)\n- [secalert@redhat.com](https://support.apple.com/kb/HT213843)\n- [secalert@redhat.com](https://support.apple.com/kb/HT213844)\n- [secalert@redhat.com](https://support.apple.com/kb/HT213845)\n- [secalert@redhat.com](http://seclists.org/fulldisclosure/2023/Jul/47)\n- [secalert@redhat.com](http://seclists.org/fulldisclosure/2023/Jul/48)\n- [secalert@redhat.com](http://seclists.org/fulldisclosure/2023/Jul/52)\n",
"disclosureTime": "2023-05-30T22:15:10.613000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.63025",
"probability": "0.00263"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openldap/libldap-2.5-0@2.5.13+dfsg-5"
],
"id": "SNYK-DEBIAN12-OPENLDAP-5660620",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-2953"
],
"CWE": [
"CWE-476"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-03T01:10:56.480285Z",
"name": "openldap/libldap-2.5-0",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "openldap",
"patches": [],
"publicationTime": "2023-05-30T13:15:45.096477Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-2953"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2023-2953"
},
{
"title": "secalert@redhat.com",
"url": "https://bugs.openldap.org/show_bug.cgi?id=9904"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20230703-0005/"
},
{
"title": "secalert@redhat.com",
"url": "https://support.apple.com/kb/HT213843"
},
{
"title": "secalert@redhat.com",
"url": "https://support.apple.com/kb/HT213844"
},
{
"title": "secalert@redhat.com",
"url": "https://support.apple.com/kb/HT213845"
},
{
"title": "secalert@redhat.com",
"url": "http://seclists.org/fulldisclosure/2023/Jul/47"
},
{
"title": "secalert@redhat.com",
"url": "http://seclists.org/fulldisclosure/2023/Jul/48"
},
{
"title": "secalert@redhat.com",
"url": "http://seclists.org/fulldisclosure/2023/Jul/52"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "NULL Pointer Dereference",
"upgradePath": [],
"version": "2.5.13+dfsg-5"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:34.862585Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:53.890325Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:00.865086Z",
"severity": "medium"
}
],
"cvssScore": 5.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n",
"disclosureTime": "2013-10-11T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75770",
"probability": "0.00614"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx@1.25.2-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555825",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-6755"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:20.838611Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2013-10-11T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-6755"
},
{
"title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/",
"url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html",
"url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html",
"url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html"
},
{
"title": "http://rump2007.cr.yp.to/15-shumow.pdf",
"url": "http://rump2007.cr.yp.to/15-shumow.pdf"
},
{
"title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/",
"url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/"
},
{
"title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html",
"url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html"
},
{
"title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect",
"url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/63657"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:38.130437Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:59.868606Z",
"severity": "medium"
}
],
"cvssScore": 5.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n",
"disclosureTime": "2010-03-05T19:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.24420",
"probability": "0.00062"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx@1.25.2-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555907",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2010-0928"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:38.644692Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2010-03-05T19:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-0928"
},
{
"title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/",
"url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/"
},
{
"title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf",
"url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf"
},
{
"title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html",
"url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html"
},
{
"title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/",
"url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/"
},
{
"title": "http://xforce.iss.net/xforce/xfdb/56750",
"url": "http://xforce.iss.net/xforce/xfdb/56750"
},
{
"title": "X-force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-07-15T01:59:11.923863Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-07-27T13:11:18.639951Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2023-07-29T11:06:24.174701Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:32:55.795420Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n",
"disclosureTime": "2023-07-14T12:15:09.023000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.64083",
"probability": "0.00278"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx@1.25.2-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5776700",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-2975"
],
"CWE": [
"CWE-287"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:32:55.795420Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-15T01:56:47.741607Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-2975"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230714.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/15/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230725-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Authentication",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-07-20T01:50:10.257559Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-25T13:32:17.801774Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-26T11:03:32.344082Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-29T01:10:57.595980Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n",
"disclosureTime": "2023-07-19T12:15:10.003000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51722",
"probability": "0.00159"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx@1.25.2-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5788322",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3446"
],
"CWE": [
"CWE-1333"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-16T13:10:45.831768Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-20T01:50:10.235107Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3446"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230719.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/4"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/6"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230803-0011/"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Inefficient Regular Expression Complexity",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-08-01T13:45:07.815112Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:31:51.629782Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T01:12:10.245558Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T11:03:42.422326Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n",
"disclosureTime": "2023-07-31T16:15:10.497000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43243",
"probability": "0.00109"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx@1.25.2-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5812633",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3817"
],
"CWE": [
"CWE-834"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-19T01:10:44.145109Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-08-01T13:44:38.433704Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3817"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230731.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://seclists.org/fulldisclosure/2023/Jul/43"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230818-0014/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Excessive Iteration",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:34.862585Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:53.890325Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:00.865086Z",
"severity": "medium"
}
],
"cvssScore": 5.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n",
"disclosureTime": "2013-10-11T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75770",
"probability": "0.00614"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-njs@1.25.2+0.8.0-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555825",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-6755"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:20.838611Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2013-10-11T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-6755"
},
{
"title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/",
"url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html",
"url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html",
"url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html"
},
{
"title": "http://rump2007.cr.yp.to/15-shumow.pdf",
"url": "http://rump2007.cr.yp.to/15-shumow.pdf"
},
{
"title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/",
"url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/"
},
{
"title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html",
"url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html"
},
{
"title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect",
"url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/63657"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:38.130437Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:59.868606Z",
"severity": "medium"
}
],
"cvssScore": 5.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n",
"disclosureTime": "2010-03-05T19:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.24420",
"probability": "0.00062"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-njs@1.25.2+0.8.0-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555907",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2010-0928"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:38.644692Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2010-03-05T19:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-0928"
},
{
"title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/",
"url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/"
},
{
"title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf",
"url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf"
},
{
"title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html",
"url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html"
},
{
"title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/",
"url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/"
},
{
"title": "http://xforce.iss.net/xforce/xfdb/56750",
"url": "http://xforce.iss.net/xforce/xfdb/56750"
},
{
"title": "X-force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-07-15T01:59:11.923863Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-07-27T13:11:18.639951Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2023-07-29T11:06:24.174701Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:32:55.795420Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n",
"disclosureTime": "2023-07-14T12:15:09.023000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.64083",
"probability": "0.00278"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-njs@1.25.2+0.8.0-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5776700",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-2975"
],
"CWE": [
"CWE-287"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:32:55.795420Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-15T01:56:47.741607Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-2975"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230714.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/15/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230725-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Authentication",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-07-20T01:50:10.257559Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-25T13:32:17.801774Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-26T11:03:32.344082Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-29T01:10:57.595980Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n",
"disclosureTime": "2023-07-19T12:15:10.003000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51722",
"probability": "0.00159"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-njs@1.25.2+0.8.0-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5788322",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3446"
],
"CWE": [
"CWE-1333"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-16T13:10:45.831768Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-20T01:50:10.235107Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3446"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230719.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/4"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/6"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230803-0011/"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Inefficient Regular Expression Complexity",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-08-01T13:45:07.815112Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:31:51.629782Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T01:12:10.245558Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T11:03:42.422326Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n",
"disclosureTime": "2023-07-31T16:15:10.497000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43243",
"probability": "0.00109"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-njs@1.25.2+0.8.0-1~bookworm",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5812633",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3817"
],
"CWE": [
"CWE-834"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-19T01:10:44.145109Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-08-01T13:44:38.433704Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3817"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230731.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://seclists.org/fulldisclosure/2023/Jul/43"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230818-0014/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Excessive Iteration",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:34.862585Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:53.890325Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:00.865086Z",
"severity": "medium"
}
],
"cvssScore": 5.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n",
"disclosureTime": "2013-10-11T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75770",
"probability": "0.00614"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555825",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-6755"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:20.838611Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2013-10-11T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-6755"
},
{
"title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/",
"url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html",
"url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html",
"url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html"
},
{
"title": "http://rump2007.cr.yp.to/15-shumow.pdf",
"url": "http://rump2007.cr.yp.to/15-shumow.pdf"
},
{
"title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/",
"url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/"
},
{
"title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html",
"url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html"
},
{
"title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect",
"url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/63657"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:38.130437Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:59.868606Z",
"severity": "medium"
}
],
"cvssScore": 5.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n",
"disclosureTime": "2010-03-05T19:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.24420",
"probability": "0.00062"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555907",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2010-0928"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:38.644692Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2010-03-05T19:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-0928"
},
{
"title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/",
"url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/"
},
{
"title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf",
"url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf"
},
{
"title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html",
"url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html"
},
{
"title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/",
"url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/"
},
{
"title": "http://xforce.iss.net/xforce/xfdb/56750",
"url": "http://xforce.iss.net/xforce/xfdb/56750"
},
{
"title": "X-force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-07-15T01:59:11.923863Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-07-27T13:11:18.639951Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2023-07-29T11:06:24.174701Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:32:55.795420Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n",
"disclosureTime": "2023-07-14T12:15:09.023000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.64083",
"probability": "0.00278"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5776700",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-2975"
],
"CWE": [
"CWE-287"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:32:55.795420Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-15T01:56:47.741607Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-2975"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230714.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/15/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230725-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Authentication",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-07-20T01:50:10.257559Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-25T13:32:17.801774Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-26T11:03:32.344082Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-29T01:10:57.595980Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n",
"disclosureTime": "2023-07-19T12:15:10.003000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51722",
"probability": "0.00159"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5788322",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3446"
],
"CWE": [
"CWE-1333"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-16T13:10:45.831768Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-20T01:50:10.235107Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3446"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230719.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/4"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/6"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230803-0011/"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Inefficient Regular Expression Complexity",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-08-01T13:45:07.815112Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:31:51.629782Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T01:12:10.245558Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T11:03:42.422326Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n",
"disclosureTime": "2023-07-31T16:15:10.497000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43243",
"probability": "0.00109"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5812633",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3817"
],
"CWE": [
"CWE-834"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-19T01:10:44.145109Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-08-01T13:44:38.433704Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3817"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230731.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://seclists.org/fulldisclosure/2023/Jul/43"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230818-0014/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Excessive Iteration",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:34.862585Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:53.890325Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:00.865086Z",
"severity": "medium"
}
],
"cvssScore": 5.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n",
"disclosureTime": "2013-10-11T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75770",
"probability": "0.00614"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555825",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-6755"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:20.838611Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2013-10-11T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-6755"
},
{
"title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/",
"url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html",
"url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html",
"url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html"
},
{
"title": "http://rump2007.cr.yp.to/15-shumow.pdf",
"url": "http://rump2007.cr.yp.to/15-shumow.pdf"
},
{
"title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/",
"url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/"
},
{
"title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html",
"url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html"
},
{
"title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect",
"url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/63657"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:38.130437Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:59.868606Z",
"severity": "medium"
}
],
"cvssScore": 5.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n",
"disclosureTime": "2010-03-05T19:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.24420",
"probability": "0.00062"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555907",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2010-0928"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:38.644692Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2010-03-05T19:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-0928"
},
{
"title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/",
"url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/"
},
{
"title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf",
"url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf"
},
{
"title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html",
"url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html"
},
{
"title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/",
"url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/"
},
{
"title": "http://xforce.iss.net/xforce/xfdb/56750",
"url": "http://xforce.iss.net/xforce/xfdb/56750"
},
{
"title": "X-force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-07-15T01:59:11.923863Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-07-27T13:11:18.639951Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2023-07-29T11:06:24.174701Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:32:55.795420Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n",
"disclosureTime": "2023-07-14T12:15:09.023000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.64083",
"probability": "0.00278"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5776700",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-2975"
],
"CWE": [
"CWE-287"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:32:55.795420Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-15T01:56:47.741607Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-2975"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230714.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/15/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230725-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Authentication",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-07-20T01:50:10.257559Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-25T13:32:17.801774Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-26T11:03:32.344082Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-29T01:10:57.595980Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n",
"disclosureTime": "2023-07-19T12:15:10.003000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51722",
"probability": "0.00159"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5788322",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3446"
],
"CWE": [
"CWE-1333"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-16T13:10:45.831768Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-20T01:50:10.235107Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3446"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230719.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/4"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/6"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230803-0011/"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Inefficient Regular Expression Complexity",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-08-01T13:45:07.815112Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:31:51.629782Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T01:12:10.245558Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T11:03:42.422326Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n",
"disclosureTime": "2023-07-31T16:15:10.497000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43243",
"probability": "0.00109"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5812633",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3817"
],
"CWE": [
"CWE-834"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-19T01:10:44.145109Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-08-01T13:44:38.433704Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3817"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230731.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://seclists.org/fulldisclosure/2023/Jul/43"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230818-0014/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Excessive Iteration",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:34.862585Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:53.890325Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:00.865086Z",
"severity": "medium"
}
],
"cvssScore": 5.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n",
"disclosureTime": "2013-10-11T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75770",
"probability": "0.00614"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"libssh2/libssh2-1@1.10.0-3+b1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555825",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-6755"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:20.838611Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2013-10-11T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-6755"
},
{
"title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/",
"url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html",
"url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html",
"url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html"
},
{
"title": "http://rump2007.cr.yp.to/15-shumow.pdf",
"url": "http://rump2007.cr.yp.to/15-shumow.pdf"
},
{
"title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/",
"url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/"
},
{
"title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html",
"url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html"
},
{
"title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect",
"url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/63657"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:38.130437Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:59.868606Z",
"severity": "medium"
}
],
"cvssScore": 5.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n",
"disclosureTime": "2010-03-05T19:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.24420",
"probability": "0.00062"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"libssh2/libssh2-1@1.10.0-3+b1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555907",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2010-0928"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:38.644692Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2010-03-05T19:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-0928"
},
{
"title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/",
"url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/"
},
{
"title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf",
"url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf"
},
{
"title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html",
"url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html"
},
{
"title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/",
"url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/"
},
{
"title": "http://xforce.iss.net/xforce/xfdb/56750",
"url": "http://xforce.iss.net/xforce/xfdb/56750"
},
{
"title": "X-force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-07-15T01:59:11.923863Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-07-27T13:11:18.639951Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2023-07-29T11:06:24.174701Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:32:55.795420Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n",
"disclosureTime": "2023-07-14T12:15:09.023000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.64083",
"probability": "0.00278"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"libssh2/libssh2-1@1.10.0-3+b1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5776700",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-2975"
],
"CWE": [
"CWE-287"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:32:55.795420Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-15T01:56:47.741607Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-2975"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230714.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/15/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230725-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Authentication",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-07-20T01:50:10.257559Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-25T13:32:17.801774Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-26T11:03:32.344082Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-29T01:10:57.595980Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n",
"disclosureTime": "2023-07-19T12:15:10.003000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51722",
"probability": "0.00159"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"libssh2/libssh2-1@1.10.0-3+b1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5788322",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3446"
],
"CWE": [
"CWE-1333"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-16T13:10:45.831768Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-20T01:50:10.235107Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3446"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230719.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/4"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/6"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230803-0011/"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Inefficient Regular Expression Complexity",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-08-01T13:45:07.815112Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:31:51.629782Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T01:12:10.245558Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T11:03:42.422326Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n",
"disclosureTime": "2023-07-31T16:15:10.497000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43243",
"probability": "0.00109"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"libssh2/libssh2-1@1.10.0-3+b1",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5812633",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3817"
],
"CWE": [
"CWE-834"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-19T01:10:44.145109Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-08-01T13:44:38.433704Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3817"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230731.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://seclists.org/fulldisclosure/2023/Jul/43"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230818-0014/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Excessive Iteration",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:34.862585Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:53.890325Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:00.865086Z",
"severity": "medium"
}
],
"cvssScore": 5.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n",
"disclosureTime": "2013-10-11T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75770",
"probability": "0.00614"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555825",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-6755"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:20.838611Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2013-10-11T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-6755"
},
{
"title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/",
"url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html",
"url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html",
"url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html"
},
{
"title": "http://rump2007.cr.yp.to/15-shumow.pdf",
"url": "http://rump2007.cr.yp.to/15-shumow.pdf"
},
{
"title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/",
"url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/"
},
{
"title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html",
"url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html"
},
{
"title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect",
"url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/63657"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:38.130437Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:59.868606Z",
"severity": "medium"
}
],
"cvssScore": 5.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n",
"disclosureTime": "2010-03-05T19:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.24420",
"probability": "0.00062"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555907",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2010-0928"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:38.644692Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2010-03-05T19:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-0928"
},
{
"title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/",
"url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/"
},
{
"title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf",
"url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf"
},
{
"title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html",
"url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html"
},
{
"title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/",
"url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/"
},
{
"title": "http://xforce.iss.net/xforce/xfdb/56750",
"url": "http://xforce.iss.net/xforce/xfdb/56750"
},
{
"title": "X-force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-07-15T01:59:11.923863Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-07-27T13:11:18.639951Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2023-07-29T11:06:24.174701Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:32:55.795420Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n",
"disclosureTime": "2023-07-14T12:15:09.023000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.64083",
"probability": "0.00278"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5776700",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-2975"
],
"CWE": [
"CWE-287"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:32:55.795420Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-15T01:56:47.741607Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-2975"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230714.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/15/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230725-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Authentication",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-07-20T01:50:10.257559Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-25T13:32:17.801774Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-26T11:03:32.344082Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-29T01:10:57.595980Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n",
"disclosureTime": "2023-07-19T12:15:10.003000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51722",
"probability": "0.00159"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5788322",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3446"
],
"CWE": [
"CWE-1333"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-16T13:10:45.831768Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-20T01:50:10.235107Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3446"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230719.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/4"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/6"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230803-0011/"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Inefficient Regular Expression Complexity",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-08-01T13:45:07.815112Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:31:51.629782Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T01:12:10.245558Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T11:03:42.422326Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n",
"disclosureTime": "2023-07-31T16:15:10.497000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43243",
"probability": "0.00109"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"curl@7.88.1-10+deb12u1",
"curl/libcurl4@7.88.1-10+deb12u1",
"krb5/libgssapi-krb5-2@1.20.1-2",
"krb5/libkrb5-3@1.20.1-2",
"openssl/libssl3@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5812633",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3817"
],
"CWE": [
"CWE-834"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-19T01:10:44.145109Z",
"name": "openssl/libssl3",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-08-01T13:44:38.433704Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3817"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230731.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://seclists.org/fulldisclosure/2023/Jul/43"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230818-0014/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Excessive Iteration",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:34.862585Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:53.890325Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:00.865086Z",
"severity": "medium"
}
],
"cvssScore": 5.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n",
"disclosureTime": "2013-10-11T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75770",
"probability": "0.00614"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555825",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-6755"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:20.838611Z",
"name": "openssl",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2013-10-11T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-6755"
},
{
"title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/",
"url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html",
"url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html"
},
{
"title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html",
"url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html"
},
{
"title": "http://rump2007.cr.yp.to/15-shumow.pdf",
"url": "http://rump2007.cr.yp.to/15-shumow.pdf"
},
{
"title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/",
"url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/"
},
{
"title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html",
"url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html"
},
{
"title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect",
"url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/63657"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:38.130437Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:59.868606Z",
"severity": "medium"
}
],
"cvssScore": 5.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n",
"disclosureTime": "2010-03-05T19:30:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.24420",
"probability": "0.00062"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-1555907",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2010-0928"
],
"CWE": [
"CWE-310"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:38.644692Z",
"name": "openssl",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2010-03-05T19:30:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-0928"
},
{
"title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/",
"url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/"
},
{
"title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf",
"url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf"
},
{
"title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html",
"url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html"
},
{
"title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/",
"url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/"
},
{
"title": "http://xforce.iss.net/xforce/xfdb/56750",
"url": "http://xforce.iss.net/xforce/xfdb/56750"
},
{
"title": "X-force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Cryptographic Issues",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-07-15T01:59:11.923863Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-07-27T13:11:18.639951Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.9,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2023-07-29T11:06:24.174701Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:32:55.795420Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n",
"disclosureTime": "2023-07-14T12:15:09.023000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.64083",
"probability": "0.00278"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5776700",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-2975"
],
"CWE": [
"CWE-287"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:32:55.795420Z",
"name": "openssl",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-15T01:56:47.741607Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-2975"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230714.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/15/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230725-0004/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Authentication",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-07-20T01:50:10.257559Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-25T13:32:17.801774Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-26T11:03:32.344082Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-07-29T01:10:57.595980Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n",
"disclosureTime": "2023-07-19T12:15:10.003000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.51722",
"probability": "0.00159"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5788322",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3446"
],
"CWE": [
"CWE-1333"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-16T13:10:45.831768Z",
"name": "openssl",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-07-20T01:50:10.235107Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3446"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230719.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/4"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/5"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/19/6"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230803-0011/"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Inefficient Regular Expression Complexity",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cpes": [],
"creationTime": "2023-08-01T13:45:07.815112Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-08-01T13:31:51.629782Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T01:12:10.245558Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2023-08-09T11:03:42.422326Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n",
"disclosureTime": "2023-07-31T16:15:10.497000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43243",
"probability": "0.00109"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"ca-certificates@20230311",
"openssl@3.0.9-1"
],
"id": "SNYK-DEBIAN12-OPENSSL-5812633",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3817"
],
"CWE": [
"CWE-834"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-19T01:10:44.145109Z",
"name": "openssl",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "openssl",
"patches": [],
"publicationTime": "2023-08-01T13:44:38.433704Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3817"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f"
},
{
"title": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5"
},
{
"title": "openssl-security@openssl.org",
"url": "https://www.openssl.org/news/secadv/20230731.txt"
},
{
"title": "openssl-security@openssl.org",
"url": "http://www.openwall.com/lists/oss-security/2023/07/31/1"
},
{
"title": "openssl-security@openssl.org",
"url": "http://seclists.org/fulldisclosure/2023/Jul/43"
},
{
"title": "openssl-security@openssl.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html"
},
{
"title": "openssl-security@openssl.org",
"url": "https://security.netapp.com/advisory/ntap-20230818-0014/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Excessive Iteration",
"upgradePath": [],
"version": "3.0.9-1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cpes": [],
"creationTime": "2021-08-15T06:58:59.954662Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"modificationTime": "2022-01-03T17:22:53.611516Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"modificationTime": "2023-02-09T11:25:02.391574Z",
"severity": "low"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n_is_safe in the File::Temp module for Perl does not properly handle symlinks.\n## Remediation\nThere is no fixed version for `Debian:12` `perl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-4116)\n- [GitHub Issue](https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14)\n- [MISC](https://rt.cpan.org/Public/Bug/Display.html?id=69106)\n- [Oss-Sec Mailing List](https://seclists.org/oss-sec/2011/q4/238)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2011/11/04/2)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2011/11/04/4)\n",
"disclosureTime": "2020-01-31T18:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.60978",
"probability": "0.00243"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"perl/perl-base@5.36.0-7"
],
"id": "SNYK-DEBIAN12-PERL-1556505",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2011-4116"
],
"CWE": [
"CWE-59"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-09T11:25:02.391574Z",
"name": "perl/perl-base",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "perl",
"patches": [],
"publicationTime": "2018-06-27T16:23:21.190689Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2011-4116"
},
{
"title": "GitHub Issue",
"url": "https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14"
},
{
"title": "MISC",
"url": "https://rt.cpan.org/Public/Bug/Display.html?id=69106"
},
{
"title": "Oss-Sec Mailing List",
"url": "https://seclists.org/oss-sec/2011/q4/238"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2011/11/04/2"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2011/11/04/4"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Link Following",
"upgradePath": [],
"version": "5.36.0-7"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2023-04-29T13:25:24.484403Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 8.1,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-05-09T01:10:09.099028Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"modificationTime": "2023-08-02T13:42:57.250231Z",
"severity": "high"
}
],
"cvssScore": 8.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nHTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.\n## Remediation\nThere is no fixed version for `Debian:12` `perl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31486)\n- [cve@mitre.org](https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/)\n- [cve@mitre.org](https://hackeriet.github.io/cpan-http-tiny-overview/)\n- [cve@mitre.org](https://www.openwall.com/lists/oss-security/2023/04/18/14)\n- [cve@mitre.org](https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/04/29/1)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/03/3)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/03/5)\n- [cve@mitre.org](https://www.openwall.com/lists/oss-security/2023/05/03/4)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/07/2)\n- [cve@mitre.org](https://github.com/chansen/p5-http-tiny/pull/153)\n",
"disclosureTime": "2023-04-29T00:15:09.083000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.58045",
"probability": "0.00210"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"perl/perl-base@5.36.0-7"
],
"id": "SNYK-DEBIAN12-PERL-5489184",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31486"
],
"CWE": [
"CWE-295"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-02T13:42:57.250231Z",
"name": "perl/perl-base",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "perl",
"patches": [],
"publicationTime": "2023-04-29T12:53:47.378128Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31486"
},
{
"title": "cve@mitre.org",
"url": "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/"
},
{
"title": "cve@mitre.org",
"url": "https://hackeriet.github.io/cpan-http-tiny-overview/"
},
{
"title": "cve@mitre.org",
"url": "https://www.openwall.com/lists/oss-security/2023/04/18/14"
},
{
"title": "cve@mitre.org",
"url": "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/"
},
{
"title": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2023/04/29/1"
},
{
"title": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2023/05/03/3"
},
{
"title": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2023/05/03/5"
},
{
"title": "cve@mitre.org",
"url": "https://www.openwall.com/lists/oss-security/2023/05/03/4"
},
{
"title": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2023/05/07/2"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/chansen/p5-http-tiny/pull/153"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Certificate Validation",
"upgradePath": [],
"version": "5.36.0-7"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2023-04-29T13:28:31.639164Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 8.1,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-05-09T01:10:08.314422Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.4,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"modificationTime": "2023-07-04T13:41:21.887677Z",
"severity": "high"
}
],
"cvssScore": 8.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nCPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.\n## Remediation\nThere is no fixed version for `Debian:12` `perl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31484)\n- [cve@mitre.org](https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/)\n- [cve@mitre.org](https://github.com/andk/cpanpm/pull/175)\n- [cve@mitre.org](https://metacpan.org/dist/CPAN/changes)\n- [cve@mitre.org](https://www.openwall.com/lists/oss-security/2023/04/18/14)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/04/29/1)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/03/3)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/03/5)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/07/2)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/)\n",
"disclosureTime": "2023-04-29T00:15:09Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.59805",
"probability": "0.00224"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"perl/perl-base@5.36.0-7"
],
"id": "SNYK-DEBIAN12-PERL-5489190",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31484"
],
"CWE": [
"CWE-295"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-03T01:10:46.794085Z",
"name": "perl/perl-base",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "perl",
"patches": [],
"publicationTime": "2023-04-29T13:26:29.033813Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31484"
},
{
"title": "cve@mitre.org",
"url": "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/andk/cpanpm/pull/175"
},
{
"title": "cve@mitre.org",
"url": "https://metacpan.org/dist/CPAN/changes"
},
{
"title": "cve@mitre.org",
"url": "https://www.openwall.com/lists/oss-security/2023/04/18/14"
},
{
"title": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2023/04/29/1"
},
{
"title": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2023/05/03/3"
},
{
"title": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2023/05/03/5"
},
{
"title": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2023/05/07/2"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Certificate Validation",
"upgradePath": [],
"version": "5.36.0-7"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:00:48.804032Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.2,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:34.700307Z",
"severity": "medium"
}
],
"cvssScore": 6.2,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ninitscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-5686)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482129/100/100/threaded)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482857/100/0/threaded)\n- [CONFIRM](https://issues.rpath.com/browse/RPL-1825)\n- [Secunia Advisory](http://secunia.com/advisories/27215)\n- [Security Focus](http://www.securityfocus.com/bid/26048)\n- [VUPEN](http://www.vupen.com/english/advisories/2007/3474)\n",
"disclosureTime": "2007-10-28T17:08:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.44187",
"probability": "0.00115"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-1559391",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-5686"
],
"CWE": [
"CWE-264"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:28.790130Z",
"name": "shadow/passwd",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2007-10-28T17:08:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-5686"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded"
},
{
"title": "CONFIRM",
"url": "https://issues.rpath.com/browse/RPL-1825"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/27215"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/26048"
},
{
"title": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3474"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access Restriction Bypass",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:00:49.238181Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.8,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T17:57:47.307851Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.8,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2022-09-01T21:39:40.719759Z",
"severity": "high"
}
],
"cvssScore": 7.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nshadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-19882)\n- [GENTOO](https://security.gentoo.org/glsa/202008-09)\n- [GitHub Commit](https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75)\n- [GitHub PR](https://github.com/shadow-maint/shadow/pull/199)\n- [GitHub PR](https://github.com/void-linux/void-packages/pull/17580)\n- [MISC](https://bugs.archlinux.org/task/64836)\n- [MISC](https://bugs.gentoo.org/702252)\n",
"disclosureTime": "2019-12-18T16:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-1559403",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-19882"
],
"CWE": [
"CWE-732"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-23T15:46:01.468382Z",
"name": "shadow/passwd",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2019-12-26T23:36:05.550389Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-19882"
},
{
"title": "GENTOO",
"url": "https://security.gentoo.org/glsa/202008-09"
},
{
"title": "GitHub Commit",
"url": "https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75"
},
{
"title": "GitHub PR",
"url": "https://github.com/shadow-maint/shadow/pull/199"
},
{
"title": "GitHub PR",
"url": "https://github.com/void-linux/void-packages/pull/17580"
},
{
"title": "MISC",
"url": "https://bugs.archlinux.org/task/64836"
},
{
"title": "MISC",
"url": "https://bugs.gentoo.org/702252"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Incorrect Permission Assignment for Critical Resource",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-02-05T01:28:06.246878Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"modificationTime": "2023-02-02T14:09:18.143374Z",
"severity": "high"
}
],
"cvssScore": null,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-0634)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-0634)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2166544)\n- [secalert@redhat.com](https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/)\n- [secalert@redhat.com](https://github.com/shadow-maint/shadow/pull/642)\n",
"disclosureTime": "2023-02-02T23:15:09.543000Z",
"epssDetails": null,
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-3310897",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-0634"
],
"CWE": [
"CWE-476"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T15:03:21.451757Z",
"name": "shadow/passwd",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2023-02-05T01:28:01.211727Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-0634"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2023-0634"
},
{
"title": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166544"
},
{
"title": "secalert@redhat.com",
"url": "https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/"
},
{
"title": "secalert@redhat.com",
"url": "https://github.com/shadow-maint/shadow/pull/642"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "NULL Pointer Dereference",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-04-15T13:42:56.921177Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-04-17T13:44:24.514320Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-04-25T01:10:07.942693Z",
"severity": "low"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-04-29T11:02:08.614218Z",
"severity": "medium"
}
],
"cvssScore": 3.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-29383)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/pull/687)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797)\n",
"disclosureTime": "2023-04-14T22:15:07.680000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.12321",
"probability": "0.00045"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-5423923",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-29383"
],
"CWE": [
"CWE-74"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-29T01:27:37.802213Z",
"name": "shadow/passwd",
"nvdSeverity": "low",
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2023-04-15T13:42:55.908897Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-29383"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/shadow-maint/shadow/pull/687"
},
{
"title": "cve@mitre.org",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/"
},
{
"title": "cve@mitre.org",
"url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Arbitrary Code Injection",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-09-01T14:50:18.745873Z",
"credit": [
""
],
"cvssDetails": [],
"cvssScore": null,
"description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4641)\n",
"disclosureTime": null,
"epssDetails": null,
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-5879156",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-4641"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-01T14:50:18.745899Z",
"name": "shadow/passwd",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2023-09-01T14:42:22.874860Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-4641"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-4641",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:00:48.804032Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.2,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:34.700307Z",
"severity": "medium"
}
],
"cvssScore": 6.2,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ninitscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-5686)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482129/100/100/threaded)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482857/100/0/threaded)\n- [CONFIRM](https://issues.rpath.com/browse/RPL-1825)\n- [Secunia Advisory](http://secunia.com/advisories/27215)\n- [Security Focus](http://www.securityfocus.com/bid/26048)\n- [VUPEN](http://www.vupen.com/english/advisories/2007/3474)\n",
"disclosureTime": "2007-10-28T17:08:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.44187",
"probability": "0.00115"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"adduser@3.134",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-1559391",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-5686"
],
"CWE": [
"CWE-264"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:28.790130Z",
"name": "shadow/passwd",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2007-10-28T17:08:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-5686"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded"
},
{
"title": "CONFIRM",
"url": "https://issues.rpath.com/browse/RPL-1825"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/27215"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/26048"
},
{
"title": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3474"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access Restriction Bypass",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:00:49.238181Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.8,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T17:57:47.307851Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.8,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2022-09-01T21:39:40.719759Z",
"severity": "high"
}
],
"cvssScore": 7.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nshadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-19882)\n- [GENTOO](https://security.gentoo.org/glsa/202008-09)\n- [GitHub Commit](https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75)\n- [GitHub PR](https://github.com/shadow-maint/shadow/pull/199)\n- [GitHub PR](https://github.com/void-linux/void-packages/pull/17580)\n- [MISC](https://bugs.archlinux.org/task/64836)\n- [MISC](https://bugs.gentoo.org/702252)\n",
"disclosureTime": "2019-12-18T16:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"adduser@3.134",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-1559403",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-19882"
],
"CWE": [
"CWE-732"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-23T15:46:01.468382Z",
"name": "shadow/passwd",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2019-12-26T23:36:05.550389Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-19882"
},
{
"title": "GENTOO",
"url": "https://security.gentoo.org/glsa/202008-09"
},
{
"title": "GitHub Commit",
"url": "https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75"
},
{
"title": "GitHub PR",
"url": "https://github.com/shadow-maint/shadow/pull/199"
},
{
"title": "GitHub PR",
"url": "https://github.com/void-linux/void-packages/pull/17580"
},
{
"title": "MISC",
"url": "https://bugs.archlinux.org/task/64836"
},
{
"title": "MISC",
"url": "https://bugs.gentoo.org/702252"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Incorrect Permission Assignment for Critical Resource",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-02-05T01:28:06.246878Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"modificationTime": "2023-02-02T14:09:18.143374Z",
"severity": "high"
}
],
"cvssScore": null,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-0634)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-0634)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2166544)\n- [secalert@redhat.com](https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/)\n- [secalert@redhat.com](https://github.com/shadow-maint/shadow/pull/642)\n",
"disclosureTime": "2023-02-02T23:15:09.543000Z",
"epssDetails": null,
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"adduser@3.134",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-3310897",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-0634"
],
"CWE": [
"CWE-476"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T15:03:21.451757Z",
"name": "shadow/passwd",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2023-02-05T01:28:01.211727Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-0634"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2023-0634"
},
{
"title": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166544"
},
{
"title": "secalert@redhat.com",
"url": "https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/"
},
{
"title": "secalert@redhat.com",
"url": "https://github.com/shadow-maint/shadow/pull/642"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "NULL Pointer Dereference",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-04-15T13:42:56.921177Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-04-17T13:44:24.514320Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-04-25T01:10:07.942693Z",
"severity": "low"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-04-29T11:02:08.614218Z",
"severity": "medium"
}
],
"cvssScore": 3.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-29383)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/pull/687)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797)\n",
"disclosureTime": "2023-04-14T22:15:07.680000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.12321",
"probability": "0.00045"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"adduser@3.134",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-5423923",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-29383"
],
"CWE": [
"CWE-74"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-29T01:27:37.802213Z",
"name": "shadow/passwd",
"nvdSeverity": "low",
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2023-04-15T13:42:55.908897Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-29383"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/shadow-maint/shadow/pull/687"
},
{
"title": "cve@mitre.org",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/"
},
{
"title": "cve@mitre.org",
"url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Arbitrary Code Injection",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-09-01T14:50:18.745873Z",
"credit": [
""
],
"cvssDetails": [],
"cvssScore": null,
"description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4641)\n",
"disclosureTime": null,
"epssDetails": null,
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"adduser@3.134",
"shadow/passwd@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-5879156",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-4641"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-01T14:50:18.745899Z",
"name": "shadow/passwd",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2023-09-01T14:42:22.874860Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-4641"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-4641",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:00:48.804032Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.2,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2023-02-09T11:22:34.700307Z",
"severity": "medium"
}
],
"cvssScore": 6.2,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ninitscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-5686)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482129/100/100/threaded)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482857/100/0/threaded)\n- [CONFIRM](https://issues.rpath.com/browse/RPL-1825)\n- [Secunia Advisory](http://secunia.com/advisories/27215)\n- [Security Focus](http://www.securityfocus.com/bid/26048)\n- [VUPEN](http://www.vupen.com/english/advisories/2007/3474)\n",
"disclosureTime": "2007-10-28T17:08:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.44187",
"probability": "0.00115"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/login@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-1559391",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2007-5686"
],
"CWE": [
"CWE-264"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:28.790130Z",
"name": "shadow/login",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2007-10-28T17:08:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2007-5686"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded"
},
{
"title": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded"
},
{
"title": "CONFIRM",
"url": "https://issues.rpath.com/browse/RPL-1825"
},
{
"title": "Secunia Advisory",
"url": "http://secunia.com/advisories/27215"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/26048"
},
{
"title": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3474"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Access Restriction Bypass",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:00:49.238181Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.8,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T17:57:47.307851Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.8,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2022-09-01T21:39:40.719759Z",
"severity": "high"
}
],
"cvssScore": 7.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nshadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-19882)\n- [GENTOO](https://security.gentoo.org/glsa/202008-09)\n- [GitHub Commit](https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75)\n- [GitHub PR](https://github.com/shadow-maint/shadow/pull/199)\n- [GitHub PR](https://github.com/void-linux/void-packages/pull/17580)\n- [MISC](https://bugs.archlinux.org/task/64836)\n- [MISC](https://bugs.gentoo.org/702252)\n",
"disclosureTime": "2019-12-18T16:15:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/login@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-1559403",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2019-19882"
],
"CWE": [
"CWE-732"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-23T15:46:01.468382Z",
"name": "shadow/login",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2019-12-26T23:36:05.550389Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2019-19882"
},
{
"title": "GENTOO",
"url": "https://security.gentoo.org/glsa/202008-09"
},
{
"title": "GitHub Commit",
"url": "https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75"
},
{
"title": "GitHub PR",
"url": "https://github.com/shadow-maint/shadow/pull/199"
},
{
"title": "GitHub PR",
"url": "https://github.com/void-linux/void-packages/pull/17580"
},
{
"title": "MISC",
"url": "https://bugs.archlinux.org/task/64836"
},
{
"title": "MISC",
"url": "https://bugs.gentoo.org/702252"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Incorrect Permission Assignment for Critical Resource",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-02-05T01:28:06.246878Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"modificationTime": "2023-02-02T14:09:18.143374Z",
"severity": "high"
}
],
"cvssScore": null,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-0634)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-0634)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2166544)\n- [secalert@redhat.com](https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/)\n- [secalert@redhat.com](https://github.com/shadow-maint/shadow/pull/642)\n",
"disclosureTime": "2023-02-02T23:15:09.543000Z",
"epssDetails": null,
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/login@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-3310897",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-0634"
],
"CWE": [
"CWE-476"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T15:03:21.451757Z",
"name": "shadow/login",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2023-02-05T01:28:01.211727Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-0634"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2023-0634"
},
{
"title": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166544"
},
{
"title": "secalert@redhat.com",
"url": "https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/"
},
{
"title": "secalert@redhat.com",
"url": "https://github.com/shadow-maint/shadow/pull/642"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "NULL Pointer Dereference",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-04-15T13:42:56.921177Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-04-17T13:44:24.514320Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-04-25T01:10:07.942693Z",
"severity": "low"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2023-04-29T11:02:08.614218Z",
"severity": "medium"
}
],
"cvssScore": 3.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-29383)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/pull/687)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797)\n",
"disclosureTime": "2023-04-14T22:15:07.680000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.12321",
"probability": "0.00045"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/login@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-5423923",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-29383"
],
"CWE": [
"CWE-74"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-29T01:27:37.802213Z",
"name": "shadow/login",
"nvdSeverity": "low",
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2023-04-15T13:42:55.908897Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-29383"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/shadow-maint/shadow/pull/687"
},
{
"title": "cve@mitre.org",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/"
},
{
"title": "cve@mitre.org",
"url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Arbitrary Code Injection",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-09-01T14:50:18.745873Z",
"credit": [
""
],
"cvssDetails": [],
"cvssScore": null,
"description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4641)\n",
"disclosureTime": null,
"epssDetails": null,
"exploit": "Not Defined",
"fixedIn": [],
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"shadow/login@1:4.13+dfsg1-1+b1"
],
"id": "SNYK-DEBIAN12-SHADOW-5879156",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-4641"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-09-01T14:50:18.745899Z",
"name": "shadow/login",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "shadow",
"patches": [],
"publicationTime": "2023-09-01T14:42:22.874860Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-4641"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-4641",
"upgradePath": [],
"version": "1:4.13+dfsg1-1+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:01:37.095633Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:04.917718Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:01.372472Z",
"severity": "medium"
}
],
"cvssScore": 4.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n",
"disclosureTime": "2013-10-28T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-1560739",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-4392"
],
"CWE": [
"CWE-59"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:25.692385Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2013-10-28T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-4392"
},
{
"title": "Debian Bug Report",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/10/01/9"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Link Following",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:09:56.188438Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.768445Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.657000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733385",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31437"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.797299Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:09:56.168947Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31437"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:10:41.420741Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:14.042342Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.707000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733390",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31438"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:14.072640Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:41.403795Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31438"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:12:26.081346Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.607988Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.753000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733398",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31439"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.638662Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:02.817493Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31439"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:01:37.095633Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:04.917718Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:01.372472Z",
"severity": "medium"
}
],
"cvssScore": 4.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n",
"disclosureTime": "2013-10-28T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-1560739",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-4392"
],
"CWE": [
"CWE-59"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:25.692385Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2013-10-28T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-4392"
},
{
"title": "Debian Bug Report",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/10/01/9"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Link Following",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:09:56.188438Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.768445Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.657000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733385",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31437"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.797299Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:09:56.168947Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31437"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:10:41.420741Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:14.042342Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.707000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733390",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31438"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:14.072640Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:41.403795Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31438"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:12:26.081346Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.607988Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.753000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733398",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31439"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.638662Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:02.817493Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31439"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:01:37.095633Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:04.917718Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:01.372472Z",
"severity": "medium"
}
],
"cvssScore": 4.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n",
"disclosureTime": "2013-10-28T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/bsdutils@1:2.38.1-5+b1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-1560739",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-4392"
],
"CWE": [
"CWE-59"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:25.692385Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2013-10-28T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-4392"
},
{
"title": "Debian Bug Report",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/10/01/9"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Link Following",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:09:56.188438Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.768445Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.657000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/bsdutils@1:2.38.1-5+b1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733385",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31437"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.797299Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:09:56.168947Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31437"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:10:41.420741Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:14.042342Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.707000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/bsdutils@1:2.38.1-5+b1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733390",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31438"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:14.072640Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:41.403795Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31438"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:12:26.081346Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.607988Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.753000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/bsdutils@1:2.38.1-5+b1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733398",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31439"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.638662Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:02.817493Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31439"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:01:37.095633Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:04.917718Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:01.372472Z",
"severity": "medium"
}
],
"cvssScore": 4.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n",
"disclosureTime": "2013-10-28T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-1560739",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-4392"
],
"CWE": [
"CWE-59"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:25.692385Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2013-10-28T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-4392"
},
{
"title": "Debian Bug Report",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/10/01/9"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Link Following",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:09:56.188438Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.768445Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.657000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733385",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31437"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.797299Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:09:56.168947Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31437"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:10:41.420741Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:14.042342Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.707000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733390",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31438"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:14.072640Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:41.403795Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31438"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:12:26.081346Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.607988Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.753000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733398",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31439"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.638662Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:02.817493Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31439"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:01:37.095633Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:04.917718Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:01.372472Z",
"severity": "medium"
}
],
"cvssScore": 4.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n",
"disclosureTime": "2013-10-28T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-1560739",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-4392"
],
"CWE": [
"CWE-59"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:25.692385Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2013-10-28T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-4392"
},
{
"title": "Debian Bug Report",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/10/01/9"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Link Following",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:09:56.188438Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.768445Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.657000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733385",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31437"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.797299Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:09:56.168947Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31437"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:10:41.420741Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:14.042342Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.707000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733390",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31438"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:14.072640Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:41.403795Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31438"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:12:26.081346Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.607988Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.753000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"systemd/libsystemd0@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733398",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31439"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.638662Z",
"name": "systemd/libsystemd0",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:02.817493Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31439"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:01:37.095633Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:04.917718Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:01.372472Z",
"severity": "medium"
}
],
"cvssScore": 4.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n",
"disclosureTime": "2013-10-28T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-1560739",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-4392"
],
"CWE": [
"CWE-59"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:25.692385Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2013-10-28T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-4392"
},
{
"title": "Debian Bug Report",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/10/01/9"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Link Following",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:09:56.188438Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.768445Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.657000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733385",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31437"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.797299Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:09:56.168947Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31437"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:10:41.420741Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:14.042342Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.707000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733390",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31438"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:14.072640Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:41.403795Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31438"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:12:26.081346Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.607988Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.753000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733398",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31439"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.638662Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:02.817493Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31439"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:01:37.095633Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:04.917718Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:01.372472Z",
"severity": "medium"
}
],
"cvssScore": 4.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n",
"disclosureTime": "2013-10-28T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-1560739",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-4392"
],
"CWE": [
"CWE-59"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:25.692385Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2013-10-28T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-4392"
},
{
"title": "Debian Bug Report",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/10/01/9"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Link Following",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:09:56.188438Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.768445Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.657000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733385",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31437"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.797299Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:09:56.168947Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31437"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:10:41.420741Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:14.042342Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.707000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733390",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31438"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:14.072640Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:41.403795Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31438"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:12:26.081346Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.607988Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.753000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733398",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31439"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.638662Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:02.817493Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31439"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cpes": [],
"creationTime": "2021-08-15T07:01:37.095633Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:24:04.917718Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.4,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"modificationTime": "2023-02-09T11:25:01.372472Z",
"severity": "medium"
}
],
"cvssScore": 4.4,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n",
"disclosureTime": "2013-10-28T22:55:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.05680",
"probability": "0.00042"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-1560739",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2013-4392"
],
"CWE": [
"CWE-59"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:25.692385Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2013-10-28T22:55:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-4392"
},
{
"title": "Debian Bug Report",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2013/10/01/9"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Link Following",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:09:56.188438Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.768445Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.657000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733385",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31437"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.797299Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:09:56.168947Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31437"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:10:41.420741Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:14.042342Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.707000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733390",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31438"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:14.072640Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:41.403795Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31438"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cpes": [],
"creationTime": "2023-06-22T14:12:26.081346Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-06-24T01:12:13.607988Z",
"severity": "medium"
}
],
"cvssScore": 5.3,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n",
"disclosureTime": "2023-06-13T17:15:14.753000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.25351",
"probability": "0.00063"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"systemd/libudev1@252.12-1~deb12u1"
],
"id": "SNYK-DEBIAN12-SYSTEMD-5733398",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-31439"
],
"CWE": [
"CWE-354"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-24T01:12:13.638662Z",
"name": "systemd/libudev1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "systemd",
"patches": [],
"publicationTime": "2023-06-22T14:10:02.817493Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-31439"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf"
},
{
"title": "cve@mitre.org",
"url": "https://github.com/systemd/systemd/releases"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Improper Validation of Integrity Check Value",
"upgradePath": [],
"version": "252.12-1~deb12u1"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:01:33.066223Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"modificationTime": "2022-09-01T13:32:26.235513Z",
"severity": "high"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 9.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-02-09T11:22:04.134667Z",
"severity": "critical"
}
],
"cvssScore": 9.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nTar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.\n## Remediation\nThere is no fixed version for `Debian:12` `tar`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2005-2541)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=112327628230258&w=2)\n- [MLIST](https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E)\n",
"disclosureTime": "2005-08-10T04:00:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75827",
"probability": "0.00617"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"tar@1.34+dfsg-1.2"
],
"id": "SNYK-DEBIAN12-TAR-1560620",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2005-2541"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:19.575213Z",
"name": "tar",
"nvdSeverity": "critical",
"packageManager": "debian:12",
"packageName": "tar",
"patches": [],
"publicationTime": "2005-08-10T04:00:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2005-2541"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=112327628230258&w=2"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2005-2541",
"upgradePath": [],
"version": "1.34+dfsg-1.2"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-01-31T01:33:03.317282Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-05-31T01:10:21.333707Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-02-21T11:02:09.756196Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-05-29T14:19:01.130316Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.\n## Remediation\nThere is no fixed version for `Debian:12` `tar`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-48303)\n- [cve@mitre.org](https://savannah.gnu.org/bugs/?62387)\n- [cve@mitre.org](https://savannah.gnu.org/patch/?10307)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/)\n",
"disclosureTime": "2023-01-30T04:15:08.030000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.08395",
"probability": "0.00044"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"tar@1.34+dfsg-1.2"
],
"id": "SNYK-DEBIAN12-TAR-3253526",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-48303"
],
"CWE": [
"CWE-125"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-31T01:10:21.357718Z",
"name": "tar",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tar",
"patches": [],
"publicationTime": "2023-01-31T01:33:03.297646Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-48303"
},
{
"title": "cve@mitre.org",
"url": "https://savannah.gnu.org/bugs/?62387"
},
{
"title": "cve@mitre.org",
"url": "https://savannah.gnu.org/patch/?10307"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-bounds Read",
"upgradePath": [],
"version": "1.34+dfsg-1.2"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:01:33.066223Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"modificationTime": "2022-09-01T13:32:26.235513Z",
"severity": "high"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 9.8,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2023-02-09T11:22:04.134667Z",
"severity": "critical"
}
],
"cvssScore": 9.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nTar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.\n## Remediation\nThere is no fixed version for `Debian:12` `tar`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2005-2541)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=112327628230258&w=2)\n- [MLIST](https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E)\n",
"disclosureTime": "2005-08-10T04:00:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75827",
"probability": "0.00617"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"dash@0.5.12-2",
"dpkg@1.21.22",
"tar@1.34+dfsg-1.2"
],
"id": "SNYK-DEBIAN12-TAR-1560620",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2005-2541"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:19.575213Z",
"name": "tar",
"nvdSeverity": "critical",
"packageManager": "debian:12",
"packageName": "tar",
"patches": [],
"publicationTime": "2005-08-10T04:00:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2005-2541"
},
{
"title": "HP Security Bulletin",
"url": "http://marc.info/?l=bugtraq&m=112327628230258&w=2"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2005-2541",
"upgradePath": [],
"version": "1.34+dfsg-1.2"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-01-31T01:33:03.317282Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-05-31T01:10:21.333707Z",
"severity": "medium"
},
{
"assigner": "SUSE",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"modificationTime": "2023-02-21T11:02:09.756196Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-05-29T14:19:01.130316Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.\n## Remediation\nThere is no fixed version for `Debian:12` `tar`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-48303)\n- [cve@mitre.org](https://savannah.gnu.org/bugs/?62387)\n- [cve@mitre.org](https://savannah.gnu.org/patch/?10307)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/)\n",
"disclosureTime": "2023-01-30T04:15:08.030000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.08395",
"probability": "0.00044"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"dash@0.5.12-2",
"dpkg@1.21.22",
"tar@1.34+dfsg-1.2"
],
"id": "SNYK-DEBIAN12-TAR-3253526",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-48303"
],
"CWE": [
"CWE-125"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-05-31T01:10:21.357718Z",
"name": "tar",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tar",
"patches": [],
"publicationTime": "2023-01-31T01:33:03.297646Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-48303"
},
{
"title": "cve@mitre.org",
"url": "https://savannah.gnu.org/bugs/?62387"
},
{
"title": "cve@mitre.org",
"url": "https://savannah.gnu.org/patch/?10307"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-bounds Read",
"upgradePath": [],
"version": "1.34+dfsg-1.2"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:01:43.543628Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-01-03T16:21:24.703910Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"modificationTime": "2022-09-01T14:49:11.956111Z",
"severity": "low"
}
],
"cvssScore": 7.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-16232)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16232)\n- [MISC](http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2017/11/01/11)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2017/11/01/3)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2017/11/01/7)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2017/11/01/8)\n- [Seclists Full Disclosure](http://seclists.org/fulldisclosure/2018/Dec/32)\n- [Seclists Full Disclosure](http://seclists.org/fulldisclosure/2018/Dec/47)\n- [Security Focus](http://www.securityfocus.com/bid/101696)\n",
"disclosureTime": "2019-03-21T15:59:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.85712",
"probability": "0.01625"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-1560922",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2017-16232"
],
"CWE": [
"CWE-772"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2022-10-31T01:44:16.684608Z",
"name": "tiff/libtiff6",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2018-06-27T16:19:41.704013Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2017-16232"
},
{
"title": "CVE Details",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16232"
},
{
"title": "MISC",
"url": "http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html"
},
{
"title": "OpenSuse Security Announcement",
"url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2017/11/01/11"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2017/11/01/3"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2017/11/01/7"
},
{
"title": "OSS security Advisory",
"url": "http://www.openwall.com/lists/oss-security/2017/11/01/8"
},
{
"title": "Seclists Full Disclosure",
"url": "http://seclists.org/fulldisclosure/2018/Dec/32"
},
{
"title": "Seclists Full Disclosure",
"url": "http://seclists.org/fulldisclosure/2018/Dec/47"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/101696"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Missing Release of Resource after Effective Lifetime",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:01:49.472704Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T16:28:04.040572Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.3,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"modificationTime": "2022-09-01T14:58:13.720843Z",
"severity": "medium"
}
],
"cvssScore": 8.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-5563)\n- [Gentoo Security Advisory](https://security.gentoo.org/glsa/201709-27)\n- [MISC](http://bugzilla.maptools.org/show_bug.cgi?id=2664)\n- [Security Focus](http://www.securityfocus.com/bid/95705)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-5563)\n- [Ubuntu Security Advisory](https://usn.ubuntu.com/3606-1/)\n",
"disclosureTime": "2017-01-23T07:59:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.73997",
"probability": "0.00538"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-1561093",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2017-5563"
],
"CWE": [
"CWE-125"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:21.099316Z",
"name": "tiff/libtiff6",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2017-01-23T07:59:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2017-5563"
},
{
"title": "Gentoo Security Advisory",
"url": "https://security.gentoo.org/glsa/201709-27"
},
{
"title": "MISC",
"url": "http://bugzilla.maptools.org/show_bug.cgi?id=2664"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/95705"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-5563"
},
{
"title": "Ubuntu Security Advisory",
"url": "https://usn.ubuntu.com/3606-1/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-bounds Read",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:01:50.766913Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 8.8,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T16:23:36.706695Z",
"severity": "high"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.5,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"modificationTime": "2022-09-01T20:53:50.836827Z",
"severity": "high"
}
],
"cvssScore": 8.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-17973)\n- [http://bugzilla.maptools.org/show_bug.cgi?id=2769](http://bugzilla.maptools.org/show_bug.cgi?id=2769)\n- [https://bugzilla.novell.com/show_bug.cgi?id=1074318](https://bugzilla.novell.com/show_bug.cgi?id=1074318)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1530912)\n- [Security Focus](http://www.securityfocus.com/bid/102331)\n",
"disclosureTime": "2017-12-29T21:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.72507",
"probability": "0.00482"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-1561130",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2017-17973"
],
"CWE": [
"CWE-416"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": true,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:16.389568Z",
"name": "tiff/libtiff6",
"nvdSeverity": "high",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2017-12-29T21:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2017-17973"
},
{
"title": "http://bugzilla.maptools.org/show_bug.cgi?id=2769",
"url": "http://bugzilla.maptools.org/show_bug.cgi?id=2769"
},
{
"title": "https://bugzilla.novell.com/show_bug.cgi?id=1074318",
"url": "https://bugzilla.novell.com/show_bug.cgi?id=1074318"
},
{
"title": "RedHat Bugzilla Bug",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1530912"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/102331"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Use After Free",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:01:59.876806Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-01-03T16:13:00.237638Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"modificationTime": "2022-09-01T21:06:42.937156Z",
"severity": "low"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-10126)\n- [MISC](http://bugzilla.maptools.org/show_bug.cgi?id=2786)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-10126)\n",
"disclosureTime": "2018-04-21T21:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.33084",
"probability": "0.00080"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-1561402",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2018-10126"
],
"CWE": [
"CWE-476"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:20.608941Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2018-04-21T21:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-10126"
},
{
"title": "MISC",
"url": "http://bugzilla.maptools.org/show_bug.cgi?id=2786"
},
{
"title": "MLIST",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-10126"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "NULL Pointer Dereference",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cpes": [],
"creationTime": "2021-08-15T07:02:08.062262Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 9.8,
"cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"modificationTime": "2022-01-03T16:31:39.112943Z",
"severity": "critical"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 3.3,
"cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"modificationTime": "2022-09-01T15:05:32.171314Z",
"severity": "low"
}
],
"cvssScore": 9.8,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-9117)\n- [MISC](http://bugzilla.maptools.org/show_bug.cgi?id=2690)\n- [Security Focus](http://www.securityfocus.com/bid/98581)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-9117)\n- [Ubuntu Security Advisory](https://usn.ubuntu.com/3606-1/)\n",
"disclosureTime": "2017-05-21T19:29:00Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.75963",
"probability": "0.00623"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-1561632",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2017-9117"
],
"CWE": [
"CWE-125"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-10T13:11:21.820010Z",
"name": "tiff/libtiff6",
"nvdSeverity": "critical",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2017-05-21T19:29:00Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2017-9117"
},
{
"title": "MISC",
"url": "http://bugzilla.maptools.org/show_bug.cgi?id=2690"
},
{
"title": "Security Focus",
"url": "http://www.securityfocus.com/bid/98581"
},
{
"title": "Ubuntu CVE Tracker",
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-9117"
},
{
"title": "Ubuntu Security Advisory",
"url": "https://usn.ubuntu.com/3606-1/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-bounds Read",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2022-04-04T01:55:37.845615Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2022-11-17T01:11:19.424883Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 4.3,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"modificationTime": "2022-11-27T21:32:51.047987Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-1210)\n- [cna@vuldb.com](https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff)\n- [cna@vuldb.com](https://gitlab.com/libtiff/libtiff/-/issues/402)\n- [cna@vuldb.com](https://vuldb.com/?id.196363)\n- [cna@vuldb.com](https://security.netapp.com/advisory/ntap-20220513-0005/)\n- [cna@vuldb.com](https://security.gentoo.org/glsa/202210-10)\n",
"disclosureTime": "2022-04-03T09:15:09.033000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.43312",
"probability": "0.00112"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-2440572",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-1210"
],
"CWE": [
"CWE-400"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:39:35.477859Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2022-04-04T01:55:09.602543Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-1210"
},
{
"title": "cna@vuldb.com",
"url": "https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff"
},
{
"title": "cna@vuldb.com",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/402"
},
{
"title": "cna@vuldb.com",
"url": "https://vuldb.com/?id.196363"
},
{
"title": "cna@vuldb.com",
"url": "https://security.netapp.com/advisory/ntap-20220513-0005/"
},
{
"title": "cna@vuldb.com",
"url": "https://security.gentoo.org/glsa/202210-10"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Resource Exhaustion",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"cpes": [],
"creationTime": "2023-04-07T13:47:31.219670Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 6.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"modificationTime": "2023-04-07T13:45:12.964278Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 6.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"modificationTime": "2023-04-19T01:10:05.651394Z",
"severity": "medium"
}
],
"cvssScore": 6.1,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-1916)\n- [secalert@redhat.com](https://gitlab.com/libtiff/libtiff/-/issues/536,)\n- [secalert@redhat.com](https://gitlab.com/libtiff/libtiff/-/issues/537)\n- [nvd@nist.gov](https://gitlab.com/libtiff/libtiff/-/issues/536)\n",
"disclosureTime": "2023-04-10T22:15:09.223000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.12930",
"probability": "0.00046"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5416364",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-1916"
],
"CWE": [
"CWE-125"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-04-19T01:10:05.674313Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-04-07T13:45:38.039231Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-1916"
},
{
"title": "secalert@redhat.com",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/536%2C"
},
{
"title": "secalert@redhat.com",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/537"
},
{
"title": "nvd@nist.gov",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/536"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-bounds Read",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-06-09T13:49:02.769774Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-06-09T13:45:30.313460Z",
"severity": "medium"
}
],
"cvssScore": null,
"description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3164)\n",
"disclosureTime": null,
"epssDetails": null,
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5673710",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3164"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-06-09T13:49:02.769794Z",
"name": "tiff/libtiff6",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-06-09T13:48:15.159265Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3164"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-3164",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-06-20T14:36:41.860913Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-06-27T13:12:19.362020Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-06-20T13:42:41.144521Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.\n\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3316)\n- [reefs@jfrog.com](https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/)\n- [reefs@jfrog.com](https://gitlab.com/libtiff/libtiff/-/issues/515)\n- [reefs@jfrog.com](https://gitlab.com/libtiff/libtiff/-/merge_requests/468)\n- [reefs@jfrog.com](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n",
"disclosureTime": "2023-06-19T12:15:09.520000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.17922",
"probability": "0.00052"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5724640",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3316"
],
"CWE": [
"CWE-476"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:10:42.700528Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-06-20T14:34:55.183235Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3316"
},
{
"title": "reefs@jfrog.com",
"url": "https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/"
},
{
"title": "reefs@jfrog.com",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/515"
},
{
"title": "reefs@jfrog.com",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/468"
},
{
"title": "reefs@jfrog.com",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "NULL Pointer Dereference",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-06-29T14:55:58.624419Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-06-28T13:42:44.998966Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-06-29T01:12:35.645915Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nloadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-26965)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/merge_requests/472)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230706-0009/)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n",
"disclosureTime": "2023-06-14T21:15:09.483000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.08313",
"probability": "0.00044"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5747599",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-26965"
],
"CWE": [
"CWE-787"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:10:42.813660Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-06-29T14:55:55.922969Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-26965"
},
{
"title": "cve@mitre.org",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/472"
},
{
"title": "cve@mitre.org",
"url": "https://security.netapp.com/advisory/ntap-20230706-0009/"
},
{
"title": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Out-of-bounds Write",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-07-01T02:14:00.280441Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-07-12T01:12:38.385697Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-07-13T15:08:27.338886Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-26966)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/issues/530)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/merge_requests/473)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n",
"disclosureTime": "2023-06-29T20:15:09.873000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.08313",
"probability": "0.00044"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5749338",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-26966"
],
"CWE": [
"CWE-120"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:10:43.178733Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-07-01T02:14:00.135262Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-26966"
},
{
"title": "cve@mitre.org",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/530"
},
{
"title": "cve@mitre.org",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/473"
},
{
"title": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Buffer Overflow",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-07-01T15:32:07.917180Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-06-30T13:59:11.123808Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-07-11T01:12:12.131969Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2908)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-2908)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2218830)\n- [secalert@redhat.com](https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f)\n- [secalert@redhat.com](https://gitlab.com/libtiff/libtiff/-/merge_requests/479)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230731-0004/)\n- [secalert@redhat.com](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n",
"disclosureTime": "2023-06-30T22:15:10.017000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.14042",
"probability": "0.00046"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5750144",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-2908"
],
"CWE": [
"CWE-476"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-03T01:10:47.686648Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-07-01T15:32:06.173406Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-2908"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2023-2908"
},
{
"title": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218830"
},
{
"title": "secalert@redhat.com",
"url": "https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f"
},
{
"title": "secalert@redhat.com",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/479"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20230731-0004/"
},
{
"title": "secalert@redhat.com",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "NULL Pointer Dereference",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-07-08T15:37:40.425363Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-07-12T01:12:38.189984Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 7.1,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"modificationTime": "2023-07-13T15:08:57.249306Z",
"severity": "high"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-25433)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/issues/520)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/merge_requests/467)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n",
"disclosureTime": "2023-06-29T20:15:09.830000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.08313",
"probability": "0.00044"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5767899",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-25433"
],
"CWE": [
"CWE-120"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-01T13:10:43.055889Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-07-08T15:36:56.802594Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-25433"
},
{
"title": "cve@mitre.org",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/520"
},
{
"title": "cve@mitre.org",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/467"
},
{
"title": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Buffer Overflow",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cpes": [],
"creationTime": "2023-07-12T15:50:25.898547Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-08-09T13:52:54.158549Z",
"severity": "medium"
},
{
"assigner": "NVD",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-07-21T01:12:29.845865Z",
"severity": "medium"
}
],
"cvssScore": 6.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3618)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-3618)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2215865)\n- [secalert@redhat.com](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230824-0012/)\n",
"disclosureTime": "2023-07-12T15:15:09.060000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.14419",
"probability": "0.00047"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5773187",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-3618"
],
"CWE": [
"CWE-120"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-25T01:10:53.786574Z",
"name": "tiff/libtiff6",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-07-12T15:50:25.879005Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-3618"
},
{
"title": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2023-3618"
},
{
"title": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215865"
},
{
"title": "secalert@redhat.com",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20230824-0012/"
}
],
"relativeImportance": "minor issue",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Buffer Overflow",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-07-25T14:50:11.605240Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-07-24T14:12:55.541722Z",
"severity": "medium"
}
],
"cvssScore": null,
"description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-38288)\n",
"disclosureTime": null,
"epssDetails": null,
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5804844",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-38288"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-07-25T14:50:11.605267Z",
"name": "tiff/libtiff6",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-07-25T14:50:01.272663Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-38288"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-38288",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-07-25T14:50:24.383752Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "Red Hat",
"cvssV3BaseScore": 6.5,
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"modificationTime": "2023-07-24T14:12:47.076929Z",
"severity": "medium"
}
],
"cvssScore": null,
"description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-38289)\n",
"disclosureTime": null,
"epssDetails": null,
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5804846",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-38289"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-07-25T14:50:24.383780Z",
"name": "tiff/libtiff6",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-07-25T14:49:55.862673Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-38289"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-38289",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-08-29T02:14:12.065902Z",
"credit": [
""
],
"cvssDetails": [],
"cvssScore": null,
"description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-40745)\n",
"disclosureTime": null,
"epssDetails": null,
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5862859",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-40745"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-29T02:14:12.065914Z",
"name": "tiff/libtiff6",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-08-29T02:14:12.010192Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-40745"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-40745",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": null,
"cpes": [],
"creationTime": "2023-08-29T02:15:15.690236Z",
"credit": [
""
],
"cvssDetails": [],
"cvssScore": null,
"description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-41175)\n",
"disclosureTime": null,
"epssDetails": null,
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"nginx-module-image-filter@1.25.2-1~bookworm",
"libgd2/libgd3@2.3.3-9",
"tiff/libtiff6@4.5.0-6"
],
"id": "SNYK-DEBIAN12-TIFF-5862863",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2023-41175"
],
"CWE": []
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-08-29T02:15:15.690263Z",
"name": "tiff/libtiff6",
"nvdSeverity": null,
"packageManager": "debian:12",
"packageName": "tiff",
"patches": [],
"publicationTime": "2023-08-29T02:14:21.842855Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2023-41175"
}
],
"relativeImportance": "not yet assigned",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "CVE-2023-41175",
"upgradePath": [],
"version": "4.5.0-6"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/libblkid1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libblkid1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"e2fsprogs@1.47.0-2",
"util-linux/libblkid1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libblkid1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/libmount1@2.38.1-5+b1",
"util-linux/libblkid1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libblkid1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/mount@2.38.1-5+b1",
"util-linux/libblkid1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libblkid1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"util-linux/libblkid1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libblkid1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/libuuid1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libuuid1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"e2fsprogs@1.47.0-2",
"util-linux/libuuid1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libuuid1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"util-linux/libuuid1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libuuid1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/bsdutils@1:2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/bsdutils",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "1:2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/libmount1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libmount1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/mount@2.38.1-5+b1",
"util-linux/libmount1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libmount1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"util-linux/libmount1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libmount1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/libsmartcols1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libsmartcols1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/mount@2.38.1-5+b1",
"util-linux/libsmartcols1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libsmartcols1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"util-linux/libsmartcols1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libsmartcols1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"util-linux/util-linux-extra@2.38.1-5+b1",
"util-linux/libsmartcols1@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/libsmartcols1",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/mount@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/mount",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux-extra@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/util-linux-extra",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1",
"util-linux/util-linux-extra@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/util-linux-extra",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
},
{
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"cpes": [],
"creationTime": "2022-02-15T03:53:14.467208Z",
"credit": [
""
],
"cvssDetails": [
{
"assigner": "NVD",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-06-04T01:10:58.797557Z",
"severity": "medium"
},
{
"assigner": "Red Hat",
"cvssV3BaseScore": 5.5,
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"modificationTime": "2022-11-27T21:31:47.261249Z",
"severity": "medium"
}
],
"cvssScore": 5.5,
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n",
"disclosureTime": "2022-02-21T19:15:08.393000Z",
"epssDetails": {
"modelVersion": "v2023.03.01",
"percentile": "0.07034",
"probability": "0.00043"
},
"exploit": "Not Defined",
"from": [
"docker-image|cyberdojo/nginx@e29d5d9",
"util-linux/util-linux@2.38.1-5+b1"
],
"id": "SNYK-DEBIAN12-UTILLINUX-2401083",
"identifiers": {
"ALTERNATIVE": [],
"CVE": [
"CVE-2022-0563"
],
"CWE": [
"CWE-209"
]
},
"insights": {
"triageAdvice": null
},
"isDisputed": false,
"isPatchable": false,
"isUpgradable": false,
"language": "linux",
"malicious": false,
"modificationTime": "2023-02-14T13:36:57.882613Z",
"name": "util-linux/util-linux",
"nvdSeverity": "medium",
"packageManager": "debian:12",
"packageName": "util-linux",
"patches": [],
"publicationTime": "2022-02-15T03:52:31.478601Z",
"references": [
{
"title": "ADVISORY",
"url": "https://security-tracker.debian.org/tracker/CVE-2022-0563"
},
{
"title": "secalert@redhat.com",
"url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u"
},
{
"title": "secalert@redhat.com",
"url": "https://security.netapp.com/advisory/ntap-20220331-0002/"
}
],
"relativeImportance": "unimportant",
"semver": {
"vulnerable": [
"*"
]
},
"severity": "low",
"severityWithCritical": "low",
"socialTrendAlert": false,
"title": "Information Exposure",
"upgradePath": [],
"version": "2.38.1-5+b1"
}
]
},
"created_at": 1694616253.007147,
"has_audit_package": true
}
},
"git_commit_info": {
"sha1": "e29d5d9469d0c432e8b5ba26e3e8a7b84e419bcf",
"message": "Add repler_hostname to nginx.conf.template\n\nAt the moment the repler service is repeatedly going up and down.\nThis is not caused by commits to the repler repo, but instead\nappears to be caused by the container failing its health checks.\nThis is causing a lot of noise in the Kosli snapshots UX for the\ntwo cyber-dojo Environments, aws-beta and aws-prod, which we\nwould like to get rid of.",
"author": "JonJagger <jon@kosli.com>",
"timestamp": 1693541235,
"branch": "main"
},
"repo_url": "https://github.com/cyber-dojo/nginx",
"template": [
"artifact"
],
"last_modified_at": 1694616253.007147,
"deployments": [
56,
55
],
"state": "NON-COMPLIANT",
"html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-archived-at-1707630884/artifacts/b9e72784672f1d1dc907947a30a5b4276eb219cc36f8da978486e5aa1e93eece",
"api_url": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/nginx-archived-at-1707630884/fingerprint/b9e72784672f1d1dc907947a30a5b4276eb219cc36f8da978486e5aa1e93eece"
}
Artifact Information |
|
| Name | cyberdojo/nginx:e29d5d9 |
| Fingerprint | b9e72784672f1d1dc907947a30a5b4276eb219cc36f8da978486e5aa1e93eece |
| Git commit |
e29d5d9
JonJagger <jon@kosli.com> (main)
1693541235.0 • 8 months ago
Add repler_hostname to nginx.conf.template
At the moment the repler service is repeatedly going up and down. This is not caused by commits to the repler repo, but instead appears to be caused by the container failing its health checks. This is causing a lot of noise in the Kosli snapshots UX for the two cyber-dojo Environments, aws-beta and aws-prod, which we would like to get rid of. |
| CI Build | https://github.com/cyber-dojo/nginx/actions/runs/6045302819 |
| Running | - |
| Exited | aws-beta#1738 aws-prod#985 |
| Last modified | 1694616253.007147 • 8 months ago |
Approvals
| None |
Evidence
Evidence for 'snyk-scan'
{ "evidence_type": "snyk", "name": "snyk-scan", "is_compliant": false, "build_url": "https://github.com/cyber-dojo/nginx/actions/runs/6045302819", "evidence_archive_fingerprint": "e9f6962dbc4613c31602651d47223b097b9a723aaef53d5b0f046bede38da03b", "user_data": {}, "snyk_results": { "applications": [ { "dependencyCount": 0, "displayTargetFile": "/usr/share/java", "docker": {}, "filesystemPolicy": false, "hasUnknownVersions": false, "ignoreSettings": { "adminOnly": false, "disregardFilesystemIgnores": false, "reasonRequired": false }, "isPrivate": true, "licensesPolicy": { "orgLicenseRules": { "AGPL-1.0": { "instructions": "", "licenseType": "AGPL-1.0", "severity": "high" }, "AGPL-3.0": { "instructions": "", "licenseType": "AGPL-3.0", "severity": "high" }, "Artistic-1.0": { "instructions": "", "licenseType": "Artistic-1.0", "severity": "medium" }, "Artistic-2.0": { "instructions": "", "licenseType": "Artistic-2.0", "severity": "medium" }, "CDDL-1.0": { "instructions": "", "licenseType": "CDDL-1.0", "severity": "medium" }, "CPOL-1.02": { "instructions": "", "licenseType": "CPOL-1.02", "severity": "high" }, "EPL-1.0": { "instructions": "", "licenseType": "EPL-1.0", "severity": "medium" }, "GPL-2.0": { "instructions": "", "licenseType": "GPL-2.0", "severity": "high" }, "GPL-3.0": { "instructions": "", "licenseType": "GPL-3.0", "severity": "high" }, "LGPL-2.0": { "instructions": "", "licenseType": "LGPL-2.0", "severity": "medium" }, "LGPL-2.1": { "instructions": "", "licenseType": "LGPL-2.1", "severity": "medium" }, "LGPL-3.0": { "instructions": "", "licenseType": "LGPL-3.0", "severity": "medium" }, "MPL-1.1": { "instructions": "", "licenseType": "MPL-1.1", "severity": "medium" }, "MPL-2.0": { "instructions": "", "licenseType": "MPL-2.0", "severity": "medium" }, "MS-RL": { "instructions": "", "licenseType": "MS-RL", "severity": "medium" }, "SimPL-2.0": { "instructions": "", "licenseType": "SimPL-2.0", "severity": "high" } }, "severities": {} }, "ok": true, "org": "fayesgw", "packageManager": "maven", "path": "cyberdojo/nginx:e29d5d9/nginx:e29d5d9:/usr/share/java", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "projectName": "cyberdojo/nginx:e29d5d9:/usr/share/java", "summary": "No known vulnerabilities", "targetFile": "/usr/share/java", "uniqueCount": 0, "vulnerabilities": [] } ], "dependencyCount": 149, "docker": { "baseImage": "nginx:1.25.2-bookworm", "baseImageRemediation": { "advice": [ { "bold": true, "message": "According to our scan, you are currently using the most secure version of the selected base image" } ], "code": "NO_REMEDIATION_AVAILABLE" } }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "hasUnknownVersions": false, "ignoreSettings": { "adminOnly": false, "disregardFilesystemIgnores": false, "reasonRequired": false }, "isPrivate": true, "licensesPolicy": { "orgLicenseRules": { "AGPL-1.0": { "instructions": "", "licenseType": "AGPL-1.0", "severity": "high" }, "AGPL-3.0": { "instructions": "", "licenseType": "AGPL-3.0", "severity": "high" }, "Artistic-1.0": { "instructions": "", "licenseType": "Artistic-1.0", "severity": "medium" }, "Artistic-2.0": { "instructions": "", "licenseType": "Artistic-2.0", "severity": "medium" }, "CDDL-1.0": { "instructions": "", "licenseType": "CDDL-1.0", "severity": "medium" }, "CPOL-1.02": { "instructions": "", "licenseType": "CPOL-1.02", "severity": "high" }, "EPL-1.0": { "instructions": "", "licenseType": "EPL-1.0", "severity": "medium" }, "GPL-2.0": { "instructions": "", "licenseType": "GPL-2.0", "severity": "high" }, "GPL-3.0": { "instructions": "", "licenseType": "GPL-3.0", "severity": "high" }, "LGPL-2.0": { "instructions": "", "licenseType": "LGPL-2.0", "severity": "medium" }, "LGPL-2.1": { "instructions": "", "licenseType": "LGPL-2.1", "severity": "medium" }, "LGPL-3.0": { "instructions": "", "licenseType": "LGPL-3.0", "severity": "medium" }, "MPL-1.1": { "instructions": "", "licenseType": "MPL-1.1", "severity": "medium" }, "MPL-2.0": { "instructions": "", "licenseType": "MPL-2.0", "severity": "medium" }, "MS-RL": { "instructions": "", "licenseType": "MS-RL", "severity": "medium" }, "SimPL-2.0": { "instructions": "", "licenseType": "SimPL-2.0", "severity": "high" } }, "severities": {} }, "ok": false, "org": "fayesgw", "packageManager": "deb", "path": "cyberdojo/nginx:e29d5d9/nginx", "platform": "linux/amd64", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "projectName": "docker-image|cyberdojo/nginx", "summary": "212 vulnerable dependency paths", "uniqueCount": 71, "vulnerabilities": [ { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-09-01T12:08:59.933511Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-09-01T01:11:04.467161Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `aom` package and not the `aom` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.\n## Remediation\nThere is no fixed version for `Debian:12` `aom`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39616)\n- [cve@mitre.org](https://bugs.chromium.org/p/aomedia/issues/detail?id=3372#c3)\n", "disclosureTime": "2023-08-29T17:15:12.633000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.13960", "probability": "0.00046" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libavif/libavif15@0.11.1-1", "aom/libaom3@3.6.0-1" ], "id": "SNYK-DEBIAN12-AOM-5878995", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-39616" ], "CWE": [ "CWE-119" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-03T00:08:57.363811Z", "name": "aom/libaom3", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "aom", "patches": [], "publicationTime": "2023-09-01T12:08:51.487137Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-39616" }, { "title": "cve@mitre.org", "url": "https://bugs.chromium.org/p/aomedia/issues/detail?id=3372%23c3" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-Bounds", "upgradePath": [], "version": "3.6.0-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-09-01T12:08:59.933511Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-09-01T01:11:04.467161Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `aom` package and not the `aom` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.\n## Remediation\nThere is no fixed version for `Debian:12` `aom`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39616)\n- [cve@mitre.org](https://bugs.chromium.org/p/aomedia/issues/detail?id=3372#c3)\n", "disclosureTime": "2023-08-29T17:15:12.633000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.13960", "probability": "0.00046" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libheif/libheif1@1.15.1-1", "aom/libaom3@3.6.0-1" ], "id": "SNYK-DEBIAN12-AOM-5878995", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-39616" ], "CWE": [ "CWE-119" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-03T00:08:57.363811Z", "name": "aom/libaom3", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "aom", "patches": [], "publicationTime": "2023-09-01T12:08:51.487137Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-39616" }, { "title": "cve@mitre.org", "url": "https://bugs.chromium.org/p/aomedia/issues/detail?id=3372%23c3" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-Bounds", "upgradePath": [], "version": "3.6.0-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:49:48.195350Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 3.7, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2022-01-03T17:20:43.650545Z", "severity": "low" } ], "cvssScore": 3.7, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `apt` package and not the `apt` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIt was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.\n## Remediation\nThere is no fixed version for `Debian:12` `apt`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3374)\n- [Debian Bug Report](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480)\n- [MISC](https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html)\n- [MISC](https://seclists.org/fulldisclosure/2011/Sep/221)\n- [MISC](https://snyk.io/vuln/SNYK-LINUX-APT-116518)\n- [MISC](https://ubuntu.com/security/CVE-2011-3374)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/cve-2011-3374)\n", "disclosureTime": "2019-11-26T00:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51982", "probability": "0.00164" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt/libapt-pkg6.0@2.6.1" ], "id": "SNYK-DEBIAN12-APT-1541449", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2011-3374" ], "CWE": [ "CWE-347" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-11-01T00:08:27.375895Z", "name": "apt/libapt-pkg6.0", "nvdSeverity": "low", "packageManager": "debian:12", "packageName": "apt", "patches": [], "publicationTime": "2018-06-27T16:20:45.037549Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2011-3374" }, { "title": "Debian Bug Report", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480" }, { "title": "MISC", "url": "https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html" }, { "title": "MISC", "url": "https://seclists.org/fulldisclosure/2011/Sep/221" }, { "title": "MISC", "url": "https://snyk.io/vuln/SNYK-LINUX-APT-116518" }, { "title": "MISC", "url": "https://ubuntu.com/security/CVE-2011-3374" }, { "title": "RedHat CVE Database", "url": "https://access.redhat.com/security/cve/cve-2011-3374" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Verification of Cryptographic Signature", "upgradePath": [], "version": "2.6.1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:49:48.195350Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 3.7, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2022-01-03T17:20:43.650545Z", "severity": "low" } ], "cvssScore": 3.7, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `apt` package and not the `apt` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIt was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.\n## Remediation\nThere is no fixed version for `Debian:12` `apt`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3374)\n- [Debian Bug Report](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480)\n- [MISC](https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html)\n- [MISC](https://seclists.org/fulldisclosure/2011/Sep/221)\n- [MISC](https://snyk.io/vuln/SNYK-LINUX-APT-116518)\n- [MISC](https://ubuntu.com/security/CVE-2011-3374)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/cve-2011-3374)\n", "disclosureTime": "2019-11-26T00:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51982", "probability": "0.00164" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1" ], "id": "SNYK-DEBIAN12-APT-1541449", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2011-3374" ], "CWE": [ "CWE-347" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-11-01T00:08:27.375895Z", "name": "apt/libapt-pkg6.0", "nvdSeverity": "low", "packageManager": "debian:12", "packageName": "apt", "patches": [], "publicationTime": "2018-06-27T16:20:45.037549Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2011-3374" }, { "title": "Debian Bug Report", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480" }, { "title": "MISC", "url": "https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html" }, { "title": "MISC", "url": "https://seclists.org/fulldisclosure/2011/Sep/221" }, { "title": "MISC", "url": "https://snyk.io/vuln/SNYK-LINUX-APT-116518" }, { "title": "MISC", "url": "https://ubuntu.com/security/CVE-2011-3374" }, { "title": "RedHat CVE Database", "url": "https://access.redhat.com/security/cve/cve-2011-3374" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Verification of Cryptographic Signature", "upgradePath": [], "version": "2.6.1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:49:48.195350Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 3.7, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2022-01-03T17:20:43.650545Z", "severity": "low" } ], "cvssScore": 3.7, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `apt` package and not the `apt` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIt was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.\n## Remediation\nThere is no fixed version for `Debian:12` `apt`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3374)\n- [Debian Bug Report](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480)\n- [MISC](https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html)\n- [MISC](https://seclists.org/fulldisclosure/2011/Sep/221)\n- [MISC](https://snyk.io/vuln/SNYK-LINUX-APT-116518)\n- [MISC](https://ubuntu.com/security/CVE-2011-3374)\n- [RedHat CVE Database](https://access.redhat.com/security/cve/cve-2011-3374)\n", "disclosureTime": "2019-11-26T00:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51982", "probability": "0.00164" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1" ], "id": "SNYK-DEBIAN12-APT-1541449", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2011-3374" ], "CWE": [ "CWE-347" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-11-01T00:08:27.375895Z", "name": "apt", "nvdSeverity": "low", "packageManager": "debian:12", "packageName": "apt", "patches": [], "publicationTime": "2018-06-27T16:20:45.037549Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2011-3374" }, { "title": "Debian Bug Report", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480" }, { "title": "MISC", "url": "https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html" }, { "title": "MISC", "url": "https://seclists.org/fulldisclosure/2011/Sep/221" }, { "title": "MISC", "url": "https://snyk.io/vuln/SNYK-LINUX-APT-116518" }, { "title": "MISC", "url": "https://ubuntu.com/security/CVE-2011-3374" }, { "title": "RedHat CVE Database", "url": "https://access.redhat.com/security/cve/cve-2011-3374" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Verification of Cryptographic Signature", "upgradePath": [], "version": "2.6.1" }, { "CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:51:16.959003Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "modificationTime": "2022-01-03T17:47:58.488186Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 8.6, "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "modificationTime": "2022-09-01T14:17:34.337978Z", "severity": "high" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `coreutils` package and not the `coreutils` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nchroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.\n## Remediation\nThere is no fixed version for `Debian:12` `coreutils`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2016-2781)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2016/02/28/2)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2016/02/28/3)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2781)\n", "disclosureTime": "2017-02-07T15:59:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "coreutils@9.1-1" ], "id": "SNYK-DEBIAN12-COREUTILS-1543939", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2016-2781" ], "CWE": [ "CWE-20" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-28T00:20:47.372219Z", "name": "coreutils", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "coreutils", "patches": [], "publicationTime": "2017-02-07T15:59:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2016-2781" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2016/02/28/2" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2016/02/28/3" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2781" } ], "relativeImportance": "low", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Input Validation", "upgradePath": [], "version": "9.1-1" }, { "CVSSv3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:51:17.267032Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.7, "cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2022-01-03T16:23:18.037192Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.2, "cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "modificationTime": "2022-11-27T19:09:01.718634Z", "severity": "medium" } ], "cvssScore": 4.7, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `coreutils` package and not the `coreutils` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.\n## Remediation\nThere is no fixed version for `Debian:12` `coreutils`.\n## References\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18018)\n- [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2017-18018)\n- [http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html](http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html)\n", "disclosureTime": "2018-01-04T04:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "coreutils@9.1-1" ], "id": "SNYK-DEBIAN12-COREUTILS-1543947", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2017-18018" ], "CWE": [ "CWE-362" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:27.811342Z", "name": "coreutils", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "coreutils", "patches": [], "publicationTime": "2018-01-04T04:29:00Z", "references": [ { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18018" }, { "title": "Debian Security Tracker", "url": "https://security-tracker.debian.org/tracker/CVE-2017-18018" }, { "title": "http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html", "url": "http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Race Condition", "upgradePath": [], "version": "9.1-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-05-11T00:22:44.040933Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "SUSE", "cvssV3BaseScore": 2.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "modificationTime": "2023-06-24T11:04:08.954791Z", "severity": "low" }, { "assigner": "NVD", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-05-17T01:10:16.232297Z", "severity": "medium" } ], "cvssScore": 5.9, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `dav1d` package and not the `dav1d` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nVideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.\n## Remediation\nThere is no fixed version for `Debian:12` `dav1d`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-32570)\n- [cve@mitre.org](https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa)\n- [cve@mitre.org](https://code.videolan.org/videolan/dav1d/-/tags/1.2.0)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/)\n", "disclosureTime": "2023-05-10T05:15:12.190000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.17973", "probability": "0.00052" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libavif/libavif15@0.11.1-1", "dav1d/libdav1d6@1.0.0-2" ], "id": "SNYK-DEBIAN12-DAV1D-5518047", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-32570" ], "CWE": [ "CWE-362" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-07-08T13:12:17.809031Z", "name": "dav1d/libdav1d6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "dav1d", "patches": [], "publicationTime": "2023-05-11T00:22:43.983561Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-32570" }, { "title": "cve@mitre.org", "url": "https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa" }, { "title": "cve@mitre.org", "url": "https://code.videolan.org/videolan/dav1d/-/tags/1.2.0" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Race Condition", "upgradePath": [], "version": "1.0.0-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-05-11T00:22:44.040933Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "SUSE", "cvssV3BaseScore": 2.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "modificationTime": "2023-06-24T11:04:08.954791Z", "severity": "low" }, { "assigner": "NVD", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-05-17T01:10:16.232297Z", "severity": "medium" } ], "cvssScore": 5.9, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `dav1d` package and not the `dav1d` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nVideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.\n## Remediation\nThere is no fixed version for `Debian:12` `dav1d`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-32570)\n- [cve@mitre.org](https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa)\n- [cve@mitre.org](https://code.videolan.org/videolan/dav1d/-/tags/1.2.0)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/)\n", "disclosureTime": "2023-05-10T05:15:12.190000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.17973", "probability": "0.00052" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libheif/libheif1@1.15.1-1", "dav1d/libdav1d6@1.0.0-2" ], "id": "SNYK-DEBIAN12-DAV1D-5518047", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-32570" ], "CWE": [ "CWE-362" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-07-08T13:12:17.809031Z", "name": "dav1d/libdav1d6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "dav1d", "patches": [], "publicationTime": "2023-05-11T00:22:43.983561Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-32570" }, { "title": "cve@mitre.org", "url": "https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa" }, { "title": "cve@mitre.org", "url": "https://code.videolan.org/videolan/dav1d/-/tags/1.2.0" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Race Condition", "upgradePath": [], "version": "1.0.0-2" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libheif/libheif1@1.15.1-1", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-njs@1.25.2+0.8.0-1~bookworm", "libxml2@2.9.14+dfsg-1.3~deb12u1", "icu/libicu72@72.1-3", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libavif/libavif15@0.11.1-1", "libgav1/libgav1-1@0.18.0-1+b1", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libavif/libavif15@0.11.1-1", "libyuv/libyuv0@0.0~git20230123.b2528b0-1", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libheif/libheif1@1.15.1-1", "libde265/libde265-0@1.0.11-1", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libheif/libheif1@1.15.1-1", "x265/libx265-199@3.5-2+b1", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6", "lerc/liblerc4@4.0.0+ds-2", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libavif/libavif15@0.11.1-1", "libgav1/libgav1-1@0.18.0-1+b1", "abseil/libabsl20220623@20220623.1-1", "gcc-12/libstdc++6@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libstdc++6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "gcc-12/gcc-12-base@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/gcc-12-base", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-11T00:43:26.423127Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-11T01:10:45.368544Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-19T15:46:28.941551Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-22T11:06:50.121676Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gcc-12` package and not the `gcc-12` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\n## Remediation\nThere is no fixed version for `Debian:12` `gcc-12`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-27943)\n- [cve@mitre.org](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039)\n- [cve@mitre.org](https://sourceware.org/bugzilla/show_bug.cgi?id=28995)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/)\n", "disclosureTime": "2022-03-26T13:15:07.900000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.16256", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "gcc-12/libgcc-s1@12.2.0-14" ], "id": "SNYK-DEBIAN12-GCC12-2606941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-27943" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:37:15.761957Z", "name": "gcc-12/libgcc-s1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gcc-12", "patches": [], "publicationTime": "2022-04-11T00:42:57.529751Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-27943" }, { "title": "cve@mitre.org", "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "title": "cve@mitre.org", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "12.2.0-14" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:53:08.248256Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-01-03T17:53:36.633029Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-09-01T21:32:37.683695Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010024)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22852)\n- [Security Focus](http://www.securityfocus.com/bid/109162)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010024)\n", "disclosureTime": "2019-07-15T04:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.88010", "probability": "0.02258" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc-bin@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1546991", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-1010024" ], "CWE": [ "CWE-200" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-26T02:06:01.383285Z", "name": "glibc/libc-bin", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-07-24T09:44:44.882448Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010024" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22852" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/109162" }, { "title": "UBUNTU", "url": "https://ubuntu.com/security/CVE-2019-1010024" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2021-08-15T06:53:10.214107Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-01-03T16:26:27.939810Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2022-10-26T21:47:02.137823Z", "severity": "medium" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-20796)\n- [CONFIRM](https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141)\n- [MISC](https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html)\n- [Netapp Security Advisory](https://security.netapp.com/advisory/ntap-20190315-0002/)\n- [Security Focus](http://www.securityfocus.com/bid/107160)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796)\n", "disclosureTime": "2019-02-26T02:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.73119", "probability": "0.00503" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc-bin@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547039", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-20796" ], "CWE": [ "CWE-674" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:45.808877Z", "name": "glibc/libc-bin", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-02-26T02:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-20796" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141" }, { "title": "MISC", "url": "https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html" }, { "title": "Netapp Security Advisory", "url": "https://security.netapp.com/advisory/ntap-20190315-0002/" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/107160" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Uncontrolled Recursion", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2021-08-15T06:53:11.542599Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-01-03T18:01:31.673539Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-9192)\n- [CONFIRM](https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=24269)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192)\n", "disclosureTime": "2019-02-26T18:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.42606", "probability": "0.00108" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc-bin@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547069", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-9192" ], "CWE": [ "CWE-674" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-26T02:05:07.667771Z", "name": "glibc/libc-bin", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-02-26T18:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-9192" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24269" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Uncontrolled Recursion", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:53:14.271602Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-01-03T17:53:25.533412Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 2.9, "cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-09-01T21:32:02.716925Z", "severity": "low" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010025)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22853)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010025)\n", "disclosureTime": "2019-07-15T04:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.62117", "probability": "0.00255" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc-bin@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547135", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-1010025" ], "CWE": [ "CWE-330" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-26T02:06:12.573238Z", "name": "glibc/libc-bin", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-07-24T09:33:59.230537Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010025" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853" }, { "title": "UBUNTU", "url": "https://ubuntu.com/security/CVE-2019-1010025" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Use of Insufficiently Random Values", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T06:53:16.627675Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 9.8, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T17:53:20.558676Z", "severity": "critical" } ], "cvssScore": 9.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010022)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22850)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010022)\n", "disclosureTime": "2019-07-15T04:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.67160", "probability": "0.00335" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc-bin@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547196", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-1010022" ], "CWE": [ "CWE-119" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-26T02:04:58.132579Z", "name": "glibc/libc-bin", "nvdSeverity": "critical", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-07-24T09:33:32.251091Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010022" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22850" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22850%23c3" }, { "title": "UBUNTU", "url": "https://ubuntu.com/security/CVE-2019-1010022" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-Bounds", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2021-08-15T06:53:21.660641Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-02-09T11:23:31.120244Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-02-09T11:25:01.944790Z", "severity": "medium" } ], "cvssScore": 4.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-4756)\n- [http://cxib.net/stuff/glob-0day.c](http://cxib.net/stuff/glob-0day.c)\n- [http://securityreason.com/achievement_securityalert/89](http://securityreason.com/achievement_securityalert/89)\n- [http://securityreason.com/exploitalert/9223](http://securityreason.com/exploitalert/9223)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=681681)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756)\n", "disclosureTime": "2011-03-02T20:00:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.79552", "probability": "0.00824" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc-bin@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547293", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2010-4756" ], "CWE": [ "CWE-399" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:43.085188Z", "name": "glibc/libc-bin", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2011-03-02T20:00:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2010-4756" }, { "title": "http://cxib.net/stuff/glob-0day.c", "url": "http://cxib.net/stuff/glob-0day.c" }, { "title": "http://securityreason.com/achievement_securityalert/89", "url": "http://securityreason.com/achievement_securityalert/89" }, { "title": "http://securityreason.com/exploitalert/9223", "url": "http://securityreason.com/exploitalert/9223" }, { "title": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=681681" }, { "title": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Management Errors", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T06:53:24.764385Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T17:53:36.820375Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 7.8, "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modificationTime": "2022-11-27T20:32:48.179719Z", "severity": "high" } ], "cvssScore": 8.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010023)\n- [CONFIRM](https://support.f5.com/csp/article/K11932200?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22851)\n- [Security Focus](http://www.securityfocus.com/bid/109167)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010023)\n", "disclosureTime": "2019-07-15T04:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.82178", "probability": "0.01070" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc-bin@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547373", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-1010023" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-11-27T20:32:48.179719Z", "name": "glibc/libc-bin", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-07-24T09:36:38.241516Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010023" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22851" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/109167" }, { "title": "UBUNTU", "url": "https://ubuntu.com/security/CVE-2019-1010023" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2019-1010023", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:53:08.248256Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-01-03T17:53:36.633029Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-09-01T21:32:37.683695Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010024)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22852)\n- [Security Focus](http://www.securityfocus.com/bid/109162)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010024)\n", "disclosureTime": "2019-07-15T04:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.88010", "probability": "0.02258" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc6@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1546991", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-1010024" ], "CWE": [ "CWE-200" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-26T02:06:01.383285Z", "name": "glibc/libc6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-07-24T09:44:44.882448Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010024" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22852" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/109162" }, { "title": "UBUNTU", "url": "https://ubuntu.com/security/CVE-2019-1010024" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2021-08-15T06:53:10.214107Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-01-03T16:26:27.939810Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2022-10-26T21:47:02.137823Z", "severity": "medium" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-20796)\n- [CONFIRM](https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141)\n- [MISC](https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html)\n- [Netapp Security Advisory](https://security.netapp.com/advisory/ntap-20190315-0002/)\n- [Security Focus](http://www.securityfocus.com/bid/107160)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796)\n", "disclosureTime": "2019-02-26T02:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.73119", "probability": "0.00503" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc6@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547039", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-20796" ], "CWE": [ "CWE-674" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:45.808877Z", "name": "glibc/libc6", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-02-26T02:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-20796" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141" }, { "title": "MISC", "url": "https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html" }, { "title": "Netapp Security Advisory", "url": "https://security.netapp.com/advisory/ntap-20190315-0002/" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/107160" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Uncontrolled Recursion", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2021-08-15T06:53:11.542599Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-01-03T18:01:31.673539Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-9192)\n- [CONFIRM](https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=24269)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192)\n", "disclosureTime": "2019-02-26T18:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.42606", "probability": "0.00108" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc6@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547069", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-9192" ], "CWE": [ "CWE-674" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-26T02:05:07.667771Z", "name": "glibc/libc6", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-02-26T18:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-9192" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24269" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Uncontrolled Recursion", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:53:14.271602Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-01-03T17:53:25.533412Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 2.9, "cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-09-01T21:32:02.716925Z", "severity": "low" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010025)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097)\n- [CONFIRM](https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22853)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010025)\n", "disclosureTime": "2019-07-15T04:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.62117", "probability": "0.00255" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc6@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547135", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-1010025" ], "CWE": [ "CWE-330" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-26T02:06:12.573238Z", "name": "glibc/libc6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-07-24T09:33:59.230537Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010025" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22853" }, { "title": "UBUNTU", "url": "https://ubuntu.com/security/CVE-2019-1010025" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Use of Insufficiently Random Values", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T06:53:16.627675Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 9.8, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T17:53:20.558676Z", "severity": "critical" } ], "cvssScore": 9.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010022)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22850)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010022)\n", "disclosureTime": "2019-07-15T04:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.67160", "probability": "0.00335" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc6@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547196", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-1010022" ], "CWE": [ "CWE-119" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-26T02:04:58.132579Z", "name": "glibc/libc6", "nvdSeverity": "critical", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-07-24T09:33:32.251091Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010022" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22850" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22850%23c3" }, { "title": "UBUNTU", "url": "https://ubuntu.com/security/CVE-2019-1010022" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-Bounds", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2021-08-15T06:53:21.660641Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-02-09T11:23:31.120244Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-02-09T11:25:01.944790Z", "severity": "medium" } ], "cvssScore": 4.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-4756)\n- [http://cxib.net/stuff/glob-0day.c](http://cxib.net/stuff/glob-0day.c)\n- [http://securityreason.com/achievement_securityalert/89](http://securityreason.com/achievement_securityalert/89)\n- [http://securityreason.com/exploitalert/9223](http://securityreason.com/exploitalert/9223)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=681681)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756)\n", "disclosureTime": "2011-03-02T20:00:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.79552", "probability": "0.00824" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc6@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547293", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2010-4756" ], "CWE": [ "CWE-399" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:43.085188Z", "name": "glibc/libc6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2011-03-02T20:00:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2010-4756" }, { "title": "http://cxib.net/stuff/glob-0day.c", "url": "http://cxib.net/stuff/glob-0day.c" }, { "title": "http://securityreason.com/achievement_securityalert/89", "url": "http://securityreason.com/achievement_securityalert/89" }, { "title": "http://securityreason.com/exploitalert/9223", "url": "http://securityreason.com/exploitalert/9223" }, { "title": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=681681" }, { "title": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Management Errors", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T06:53:24.764385Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T17:53:36.820375Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 7.8, "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modificationTime": "2022-11-27T20:32:48.179719Z", "severity": "high" } ], "cvssScore": 8.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."\n## Remediation\nThere is no fixed version for `Debian:12` `glibc`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-1010023)\n- [CONFIRM](https://support.f5.com/csp/article/K11932200?utm_source=f5support&utm_medium=RSS)\n- [MISC](https://sourceware.org/bugzilla/show_bug.cgi?id=22851)\n- [Security Focus](http://www.securityfocus.com/bid/109167)\n- [UBUNTU](https://ubuntu.com/security/CVE-2019-1010023)\n", "disclosureTime": "2019-07-15T04:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.82178", "probability": "0.01070" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "glibc/libc6@2.36-9+deb12u1" ], "id": "SNYK-DEBIAN12-GLIBC-1547373", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-1010023" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-11-27T20:32:48.179719Z", "name": "glibc/libc6", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "glibc", "patches": [], "publicationTime": "2019-07-24T09:36:38.241516Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-1010023" }, { "title": "CONFIRM", "url": "https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS" }, { "title": "MISC", "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=22851" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/109167" }, { "title": "UBUNTU", "url": "https://ubuntu.com/security/CVE-2019-1010023" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2019-1010023", "upgradePath": [], "version": "2.36-9+deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-02-24T00:35:02.015920Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 6.2, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-10-26T01:05:09.249829Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-05-27T01:10:18.011236Z", "severity": "low" } ], "cvssScore": 3.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nGnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.\n## Remediation\nThere is no fixed version for `Debian:12` `gnupg2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-3219)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2022-3219)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2127010)\n- [secalert@redhat.com](https://dev.gnupg.org/D556)\n- [secalert@redhat.com](https://dev.gnupg.org/T5993)\n- [secalert@redhat.com](https://marc.info/?l=oss-security&m=165696590211434&w=4)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230324-0001/)\n", "disclosureTime": "2023-02-23T20:15:12.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.08370", "probability": "0.00044" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "gnupg2/gpgv@2.2.40-1.1" ], "id": "SNYK-DEBIAN12-GNUPG2-3330747", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-3219" ], "CWE": [ "CWE-787" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-27T01:10:18.044819Z", "name": "gnupg2/gpgv", "nvdSeverity": "low", "packageManager": "debian:12", "packageName": "gnupg2", "patches": [], "publicationTime": "2023-02-24T00:34:45.839506Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-3219" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2022-3219" }, { "title": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010" }, { "title": "secalert@redhat.com", "url": "https://dev.gnupg.org/D556" }, { "title": "secalert@redhat.com", "url": "https://dev.gnupg.org/T5993" }, { "title": "secalert@redhat.com", "url": "https://marc.info/?l=oss-security&m=165696590211434&w=4" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20230324-0001/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-bounds Write", "upgradePath": [], "version": "2.2.40-1.1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-02-24T00:35:02.015920Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 6.2, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-10-26T01:05:09.249829Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-05-27T01:10:18.011236Z", "severity": "low" } ], "cvssScore": 3.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nGnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.\n## Remediation\nThere is no fixed version for `Debian:12` `gnupg2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-3219)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2022-3219)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2127010)\n- [secalert@redhat.com](https://dev.gnupg.org/D556)\n- [secalert@redhat.com](https://dev.gnupg.org/T5993)\n- [secalert@redhat.com](https://marc.info/?l=oss-security&m=165696590211434&w=4)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230324-0001/)\n", "disclosureTime": "2023-02-23T20:15:12.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.08370", "probability": "0.00044" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "gnupg2/gpgv@2.2.40-1.1" ], "id": "SNYK-DEBIAN12-GNUPG2-3330747", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-3219" ], "CWE": [ "CWE-787" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-27T01:10:18.044819Z", "name": "gnupg2/gpgv", "nvdSeverity": "low", "packageManager": "debian:12", "packageName": "gnupg2", "patches": [], "publicationTime": "2023-02-24T00:34:45.839506Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-3219" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2022-3219" }, { "title": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010" }, { "title": "secalert@redhat.com", "url": "https://dev.gnupg.org/D556" }, { "title": "secalert@redhat.com", "url": "https://dev.gnupg.org/T5993" }, { "title": "secalert@redhat.com", "url": "https://marc.info/?l=oss-security&m=165696590211434&w=4" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20230324-0001/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-bounds Write", "upgradePath": [], "version": "2.2.40-1.1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:53:13.601907Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "modificationTime": "2023-02-09T11:23:41.981191Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 3.7, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-05-03T23:39:05.043124Z", "severity": "low" }, { "assigner": "NVD", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "modificationTime": "2023-02-09T11:23:18.530513Z", "severity": "medium" } ], "cvssScore": 4.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.\n## Remediation\nThere is no fixed version for `Debian:12` `gnutls28`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3389)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html)\n- [Apple Security Advisory](http://support.apple.com/kb/HT4999)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5001)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5130)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5281)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5501)\n- [Apple Security Advisory](http://support.apple.com/kb/HT6150)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/May/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html)\n- [CERT](http://www.us-cert.gov/cas/techalerts/TA12-010A.html)\n- [Cert Vulnerability Note](http://www.kb.cert.org/vuls/id/864643)\n- [Chrome Release](http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html)\n- [CONFIRM](http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/)\n- [CONFIRM](http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx)\n- [CONFIRM](http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx)\n- [CONFIRM](http://curl.haxx.se/docs/adv_20120124B.html)\n- [CONFIRM](http://downloads.asterisk.org/pub/security/AST-2016-001.html)\n- [CONFIRM](http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue)\n- [CONFIRM](https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail)\n- [CONFIRM](https://bugzilla.novell.com/show_bug.cgi?id=719047)\n- [CONFIRM](https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf)\n- [CONFIRM](http://technet.microsoft.com/security/advisory/2588513)\n- [CONFIRM](http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf)\n- [CONFIRM](http://www.ibm.com/developerworks/java/jdk/alerts/)\n- [CONFIRM](http://www.imperialviolet.org/2011/09/23/chromeandbeast.html)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1160/)\n- [CONFIRM](http://www.opera.com/support/kb/view/1004/)\n- [Debian Security Advisory](http://www.debian.org/security/2012/dsa-2398)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201203-02.xml)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201406-32.xml)\n- [HP](https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132750579901589&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132872385320240&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133365109612558&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133728004526190&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254866602253&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254957702612&w=2)\n- [MISC](http://ekoparty.org/2011/juliano-rizzo.php)\n- [MISC](http://eprint.iacr.org/2004/111)\n- [MISC](http://eprint.iacr.org/2006/136)\n- [MISC](http://isc.sans.edu/diary/SSL+TLS+part+3+/11635)\n- [MISC](https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02)\n- [MISC](http://vnhacker.blogspot.com/2011/09/beast.html)\n- [MISC](http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html)\n- [MISC](http://www.insecure.cl/Beast-SSL.rar)\n- [MS](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006)\n- [MS](http://technet.microsoft.com/security/bulletin/MS12-006)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html)\n- [OSVDB](http://osvdb.org/74829)\n- [Oval Security](https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=737506)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2012-0508.html)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2013-1455.html)\n- [Secunia Advisory](http://secunia.com/advisories/45791)\n- [Secunia Advisory](http://secunia.com/advisories/47998)\n- [Secunia Advisory](http://secunia.com/advisories/48256)\n- [Secunia Advisory](http://secunia.com/advisories/48692)\n- [Secunia Advisory](http://secunia.com/advisories/48915)\n- [Secunia Advisory](http://secunia.com/advisories/48948)\n- [Secunia Advisory](http://secunia.com/advisories/49198)\n- [Secunia Advisory](http://secunia.com/advisories/55322)\n- [Secunia Advisory](http://secunia.com/advisories/55350)\n- [Secunia Advisory](http://secunia.com/advisories/55351)\n- [Security Focus](http://www.securityfocus.com/bid/49388)\n- [Security Focus](http://www.securityfocus.com/bid/49778)\n- [Security Tracker](http://www.securitytracker.com/id?1025997)\n- [Security Tracker](http://www.securitytracker.com/id?1026103)\n- [Security Tracker](http://www.securitytracker.com/id?1026704)\n- [Security Tracker](http://www.securitytracker.com/id/1029190)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html)\n- [SUSE](https://hermes.opensuse.org/messages/13154861)\n- [SUSE](https://hermes.opensuse.org/messages/13155432)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389)\n- [Ubuntu Security Advisory](http://www.ubuntu.com/usn/USN-1263-1)\n", "disclosureTime": "2011-09-06T19:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.57824", "probability": "0.00211" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "gnutls28/libgnutls30@3.7.9-2" ], "id": "SNYK-DEBIAN12-GNUTLS28-1547121", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2011-3389" ], "CWE": [ "CWE-20" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:43.062945Z", "name": "gnutls28/libgnutls30", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gnutls28", "patches": [], "publicationTime": "2011-09-06T19:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2011-3389" }, { "title": "APPLE", "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html" }, { "title": "APPLE", "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT4999" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5001" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5130" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5281" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5501" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT6150" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html" }, { "title": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA12-010A.html" }, { "title": "Cert Vulnerability Note", "url": "http://www.kb.cert.org/vuls/id/864643" }, { "title": "Chrome Release", "url": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html" }, { "title": "CONFIRM", "url": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/" }, { "title": "CONFIRM", "url": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx" }, { "title": "CONFIRM", "url": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx" }, { "title": "CONFIRM", "url": "http://curl.haxx.se/docs/adv_20120124B.html" }, { "title": "CONFIRM", "url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html" }, { "title": "CONFIRM", "url": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue" }, { "title": "CONFIRM", "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail" }, { "title": "CONFIRM", "url": "https://bugzilla.novell.com/show_bug.cgi?id=719047" }, { "title": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" }, { "title": "CONFIRM", "url": "http://technet.microsoft.com/security/advisory/2588513" }, { "title": "CONFIRM", "url": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf" }, { "title": "CONFIRM", "url": "http://www.ibm.com/developerworks/java/jdk/alerts/" }, { "title": "CONFIRM", "url": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/mac/1151/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/mac/1160/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/unix/1151/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/unix/1160/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/windows/1151/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/windows/1160/" }, { "title": "CONFIRM", "url": "http://www.opera.com/support/kb/view/1004/" }, { "title": "Debian Security Advisory", "url": "http://www.debian.org/security/2012/dsa-2398" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201203-02.xml" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml" }, { "title": "HP", "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=132750579901589&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=132872385320240&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=133365109612558&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=133728004526190&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=134254866602253&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=134254957702612&w=2" }, { "title": "MISC", "url": "http://ekoparty.org/2011/juliano-rizzo.php" }, { "title": "MISC", "url": "http://eprint.iacr.org/2004/111" }, { "title": "MISC", "url": "http://eprint.iacr.org/2006/136" }, { "title": "MISC", "url": "http://isc.sans.edu/diary/SSL%2BTLS%2Bpart%2B3%2B/11635" }, { "title": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "title": "MISC", "url": "http://vnhacker.blogspot.com/2011/09/beast.html" }, { "title": "MISC", "url": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html" }, { "title": "MISC", "url": "http://www.insecure.cl/Beast-SSL.rar" }, { "title": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006" }, { "title": "MS", "url": "http://technet.microsoft.com/security/bulletin/MS12-006" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html" }, { "title": "OSVDB", "url": "http://osvdb.org/74829" }, { "title": "Oval Security", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=737506" }, { "title": "RedHat Security Advisory", "url": "http://rhn.redhat.com/errata/RHSA-2012-0508.html" }, { "title": "RedHat Security Advisory", "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/45791" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/47998" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48256" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48692" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48915" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48948" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/49198" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55322" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55350" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55351" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/49388" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/49778" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id?1025997" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id?1026103" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id?1026704" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id/1029190" }, { "title": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html" }, { "title": "SUSE", "url": "https://hermes.opensuse.org/messages/13154861" }, { "title": "SUSE", "url": "https://hermes.opensuse.org/messages/13155432" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389" }, { "title": "Ubuntu Security Advisory", "url": "http://www.ubuntu.com/usn/USN-1263-1" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Input Validation", "upgradePath": [], "version": "3.7.9-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:53:13.601907Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "modificationTime": "2023-02-09T11:23:41.981191Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 3.7, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-05-03T23:39:05.043124Z", "severity": "low" }, { "assigner": "NVD", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "modificationTime": "2023-02-09T11:23:18.530513Z", "severity": "medium" } ], "cvssScore": 4.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.\n## Remediation\nThere is no fixed version for `Debian:12` `gnutls28`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3389)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html)\n- [Apple Security Advisory](http://support.apple.com/kb/HT4999)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5001)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5130)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5281)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5501)\n- [Apple Security Advisory](http://support.apple.com/kb/HT6150)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/May/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html)\n- [CERT](http://www.us-cert.gov/cas/techalerts/TA12-010A.html)\n- [Cert Vulnerability Note](http://www.kb.cert.org/vuls/id/864643)\n- [Chrome Release](http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html)\n- [CONFIRM](http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/)\n- [CONFIRM](http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx)\n- [CONFIRM](http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx)\n- [CONFIRM](http://curl.haxx.se/docs/adv_20120124B.html)\n- [CONFIRM](http://downloads.asterisk.org/pub/security/AST-2016-001.html)\n- [CONFIRM](http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue)\n- [CONFIRM](https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail)\n- [CONFIRM](https://bugzilla.novell.com/show_bug.cgi?id=719047)\n- [CONFIRM](https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf)\n- [CONFIRM](http://technet.microsoft.com/security/advisory/2588513)\n- [CONFIRM](http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf)\n- [CONFIRM](http://www.ibm.com/developerworks/java/jdk/alerts/)\n- [CONFIRM](http://www.imperialviolet.org/2011/09/23/chromeandbeast.html)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1160/)\n- [CONFIRM](http://www.opera.com/support/kb/view/1004/)\n- [Debian Security Advisory](http://www.debian.org/security/2012/dsa-2398)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201203-02.xml)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201406-32.xml)\n- [HP](https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132750579901589&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132872385320240&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133365109612558&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133728004526190&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254866602253&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254957702612&w=2)\n- [MISC](http://ekoparty.org/2011/juliano-rizzo.php)\n- [MISC](http://eprint.iacr.org/2004/111)\n- [MISC](http://eprint.iacr.org/2006/136)\n- [MISC](http://isc.sans.edu/diary/SSL+TLS+part+3+/11635)\n- [MISC](https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02)\n- [MISC](http://vnhacker.blogspot.com/2011/09/beast.html)\n- [MISC](http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html)\n- [MISC](http://www.insecure.cl/Beast-SSL.rar)\n- [MS](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006)\n- [MS](http://technet.microsoft.com/security/bulletin/MS12-006)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html)\n- [OSVDB](http://osvdb.org/74829)\n- [Oval Security](https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=737506)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2012-0508.html)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2013-1455.html)\n- [Secunia Advisory](http://secunia.com/advisories/45791)\n- [Secunia Advisory](http://secunia.com/advisories/47998)\n- [Secunia Advisory](http://secunia.com/advisories/48256)\n- [Secunia Advisory](http://secunia.com/advisories/48692)\n- [Secunia Advisory](http://secunia.com/advisories/48915)\n- [Secunia Advisory](http://secunia.com/advisories/48948)\n- [Secunia Advisory](http://secunia.com/advisories/49198)\n- [Secunia Advisory](http://secunia.com/advisories/55322)\n- [Secunia Advisory](http://secunia.com/advisories/55350)\n- [Secunia Advisory](http://secunia.com/advisories/55351)\n- [Security Focus](http://www.securityfocus.com/bid/49388)\n- [Security Focus](http://www.securityfocus.com/bid/49778)\n- [Security Tracker](http://www.securitytracker.com/id?1025997)\n- [Security Tracker](http://www.securitytracker.com/id?1026103)\n- [Security Tracker](http://www.securitytracker.com/id?1026704)\n- [Security Tracker](http://www.securitytracker.com/id/1029190)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html)\n- [SUSE](https://hermes.opensuse.org/messages/13154861)\n- [SUSE](https://hermes.opensuse.org/messages/13155432)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389)\n- [Ubuntu Security Advisory](http://www.ubuntu.com/usn/USN-1263-1)\n", "disclosureTime": "2011-09-06T19:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.57824", "probability": "0.00211" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "rtmpdump/librtmp1@2.4+20151223.gitfa8646d.1-2+b2", "gnutls28/libgnutls30@3.7.9-2" ], "id": "SNYK-DEBIAN12-GNUTLS28-1547121", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2011-3389" ], "CWE": [ "CWE-20" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:43.062945Z", "name": "gnutls28/libgnutls30", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gnutls28", "patches": [], "publicationTime": "2011-09-06T19:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2011-3389" }, { "title": "APPLE", "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html" }, { "title": "APPLE", "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT4999" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5001" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5130" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5281" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5501" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT6150" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html" }, { "title": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA12-010A.html" }, { "title": "Cert Vulnerability Note", "url": "http://www.kb.cert.org/vuls/id/864643" }, { "title": "Chrome Release", "url": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html" }, { "title": "CONFIRM", "url": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/" }, { "title": "CONFIRM", "url": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx" }, { "title": "CONFIRM", "url": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx" }, { "title": "CONFIRM", "url": "http://curl.haxx.se/docs/adv_20120124B.html" }, { "title": "CONFIRM", "url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html" }, { "title": "CONFIRM", "url": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue" }, { "title": "CONFIRM", "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail" }, { "title": "CONFIRM", "url": "https://bugzilla.novell.com/show_bug.cgi?id=719047" }, { "title": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" }, { "title": "CONFIRM", "url": "http://technet.microsoft.com/security/advisory/2588513" }, { "title": "CONFIRM", "url": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf" }, { "title": "CONFIRM", "url": "http://www.ibm.com/developerworks/java/jdk/alerts/" }, { "title": "CONFIRM", "url": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/mac/1151/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/mac/1160/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/unix/1151/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/unix/1160/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/windows/1151/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/windows/1160/" }, { "title": "CONFIRM", "url": "http://www.opera.com/support/kb/view/1004/" }, { "title": "Debian Security Advisory", "url": "http://www.debian.org/security/2012/dsa-2398" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201203-02.xml" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml" }, { "title": "HP", "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=132750579901589&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=132872385320240&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=133365109612558&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=133728004526190&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=134254866602253&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=134254957702612&w=2" }, { "title": "MISC", "url": "http://ekoparty.org/2011/juliano-rizzo.php" }, { "title": "MISC", "url": "http://eprint.iacr.org/2004/111" }, { "title": "MISC", "url": "http://eprint.iacr.org/2006/136" }, { "title": "MISC", "url": "http://isc.sans.edu/diary/SSL%2BTLS%2Bpart%2B3%2B/11635" }, { "title": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "title": "MISC", "url": "http://vnhacker.blogspot.com/2011/09/beast.html" }, { "title": "MISC", "url": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html" }, { "title": "MISC", "url": "http://www.insecure.cl/Beast-SSL.rar" }, { "title": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006" }, { "title": "MS", "url": "http://technet.microsoft.com/security/bulletin/MS12-006" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html" }, { "title": "OSVDB", "url": "http://osvdb.org/74829" }, { "title": "Oval Security", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=737506" }, { "title": "RedHat Security Advisory", "url": "http://rhn.redhat.com/errata/RHSA-2012-0508.html" }, { "title": "RedHat Security Advisory", "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/45791" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/47998" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48256" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48692" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48915" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48948" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/49198" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55322" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55350" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55351" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/49388" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/49778" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id?1025997" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id?1026103" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id?1026704" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id/1029190" }, { "title": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html" }, { "title": "SUSE", "url": "https://hermes.opensuse.org/messages/13154861" }, { "title": "SUSE", "url": "https://hermes.opensuse.org/messages/13155432" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389" }, { "title": "Ubuntu Security Advisory", "url": "http://www.ubuntu.com/usn/USN-1263-1" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Input Validation", "upgradePath": [], "version": "3.7.9-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:53:13.601907Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "modificationTime": "2023-02-09T11:23:41.981191Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 3.7, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-05-03T23:39:05.043124Z", "severity": "low" }, { "assigner": "NVD", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "modificationTime": "2023-02-09T11:23:18.530513Z", "severity": "medium" } ], "cvssScore": 4.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.\n## Remediation\nThere is no fixed version for `Debian:12` `gnutls28`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-3389)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html)\n- [APPLE](http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html)\n- [Apple Security Advisory](http://support.apple.com/kb/HT4999)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5001)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5130)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5281)\n- [Apple Security Advisory](http://support.apple.com/kb/HT5501)\n- [Apple Security Advisory](http://support.apple.com/kb/HT6150)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/May/msg00001.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html)\n- [Apple Security Announcement](http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html)\n- [CERT](http://www.us-cert.gov/cas/techalerts/TA12-010A.html)\n- [Cert Vulnerability Note](http://www.kb.cert.org/vuls/id/864643)\n- [Chrome Release](http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html)\n- [CONFIRM](http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/)\n- [CONFIRM](http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx)\n- [CONFIRM](http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx)\n- [CONFIRM](http://curl.haxx.se/docs/adv_20120124B.html)\n- [CONFIRM](http://downloads.asterisk.org/pub/security/AST-2016-001.html)\n- [CONFIRM](http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue)\n- [CONFIRM](https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail)\n- [CONFIRM](https://bugzilla.novell.com/show_bug.cgi?id=719047)\n- [CONFIRM](https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf)\n- [CONFIRM](http://technet.microsoft.com/security/advisory/2588513)\n- [CONFIRM](http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf)\n- [CONFIRM](http://www.ibm.com/developerworks/java/jdk/alerts/)\n- [CONFIRM](http://www.imperialviolet.org/2011/09/23/chromeandbeast.html)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/mac/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/unix/1160/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1151/)\n- [CONFIRM](http://www.opera.com/docs/changelogs/windows/1160/)\n- [CONFIRM](http://www.opera.com/support/kb/view/1004/)\n- [Debian Security Advisory](http://www.debian.org/security/2012/dsa-2398)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201203-02.xml)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201406-32.xml)\n- [HP](https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132750579901589&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=132872385320240&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133365109612558&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=133728004526190&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254866602253&w=2)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=134254957702612&w=2)\n- [MISC](http://ekoparty.org/2011/juliano-rizzo.php)\n- [MISC](http://eprint.iacr.org/2004/111)\n- [MISC](http://eprint.iacr.org/2006/136)\n- [MISC](http://isc.sans.edu/diary/SSL+TLS+part+3+/11635)\n- [MISC](https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02)\n- [MISC](http://vnhacker.blogspot.com/2011/09/beast.html)\n- [MISC](http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html)\n- [MISC](http://www.insecure.cl/Beast-SSL.rar)\n- [MS](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006)\n- [MS](http://technet.microsoft.com/security/bulletin/MS12-006)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html)\n- [OSVDB](http://osvdb.org/74829)\n- [Oval Security](https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=737506)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2012-0508.html)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2013-1455.html)\n- [Secunia Advisory](http://secunia.com/advisories/45791)\n- [Secunia Advisory](http://secunia.com/advisories/47998)\n- [Secunia Advisory](http://secunia.com/advisories/48256)\n- [Secunia Advisory](http://secunia.com/advisories/48692)\n- [Secunia Advisory](http://secunia.com/advisories/48915)\n- [Secunia Advisory](http://secunia.com/advisories/48948)\n- [Secunia Advisory](http://secunia.com/advisories/49198)\n- [Secunia Advisory](http://secunia.com/advisories/55322)\n- [Secunia Advisory](http://secunia.com/advisories/55350)\n- [Secunia Advisory](http://secunia.com/advisories/55351)\n- [Security Focus](http://www.securityfocus.com/bid/49388)\n- [Security Focus](http://www.securityfocus.com/bid/49778)\n- [Security Tracker](http://www.securitytracker.com/id?1025997)\n- [Security Tracker](http://www.securitytracker.com/id?1026103)\n- [Security Tracker](http://www.securitytracker.com/id?1026704)\n- [Security Tracker](http://www.securitytracker.com/id/1029190)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html)\n- [SUSE](https://hermes.opensuse.org/messages/13154861)\n- [SUSE](https://hermes.opensuse.org/messages/13155432)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389)\n- [Ubuntu Security Advisory](http://www.ubuntu.com/usn/USN-1263-1)\n", "disclosureTime": "2011-09-06T19:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.57824", "probability": "0.00211" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openldap/libldap-2.5-0@2.5.13+dfsg-5", "gnutls28/libgnutls30@3.7.9-2" ], "id": "SNYK-DEBIAN12-GNUTLS28-1547121", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2011-3389" ], "CWE": [ "CWE-20" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:43.062945Z", "name": "gnutls28/libgnutls30", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "gnutls28", "patches": [], "publicationTime": "2011-09-06T19:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2011-3389" }, { "title": "APPLE", "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html" }, { "title": "APPLE", "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT4999" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5001" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5130" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5281" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT5501" }, { "title": "Apple Security Advisory", "url": "http://support.apple.com/kb/HT6150" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html" }, { "title": "Apple Security Announcement", "url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html" }, { "title": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA12-010A.html" }, { "title": "Cert Vulnerability Note", "url": "http://www.kb.cert.org/vuls/id/864643" }, { "title": "Chrome Release", "url": "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html" }, { "title": "CONFIRM", "url": "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/" }, { "title": "CONFIRM", "url": "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx" }, { "title": "CONFIRM", "url": "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx" }, { "title": "CONFIRM", "url": "http://curl.haxx.se/docs/adv_20120124B.html" }, { "title": "CONFIRM", "url": "http://downloads.asterisk.org/pub/security/AST-2016-001.html" }, { "title": "CONFIRM", "url": "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue" }, { "title": "CONFIRM", "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail" }, { "title": "CONFIRM", "url": "https://bugzilla.novell.com/show_bug.cgi?id=719047" }, { "title": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf" }, { "title": "CONFIRM", "url": "http://technet.microsoft.com/security/advisory/2588513" }, { "title": "CONFIRM", "url": "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf" }, { "title": "CONFIRM", "url": "http://www.ibm.com/developerworks/java/jdk/alerts/" }, { "title": "CONFIRM", "url": "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/mac/1151/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/mac/1160/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/unix/1151/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/unix/1160/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/windows/1151/" }, { "title": "CONFIRM", "url": "http://www.opera.com/docs/changelogs/windows/1160/" }, { "title": "CONFIRM", "url": "http://www.opera.com/support/kb/view/1004/" }, { "title": "Debian Security Advisory", "url": "http://www.debian.org/security/2012/dsa-2398" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201203-02.xml" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml" }, { "title": "HP", "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=132750579901589&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=132872385320240&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=133365109612558&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=133728004526190&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=134254866602253&w=2" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=134254957702612&w=2" }, { "title": "MISC", "url": "http://ekoparty.org/2011/juliano-rizzo.php" }, { "title": "MISC", "url": "http://eprint.iacr.org/2004/111" }, { "title": "MISC", "url": "http://eprint.iacr.org/2006/136" }, { "title": "MISC", "url": "http://isc.sans.edu/diary/SSL%2BTLS%2Bpart%2B3%2B/11635" }, { "title": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02" }, { "title": "MISC", "url": "http://vnhacker.blogspot.com/2011/09/beast.html" }, { "title": "MISC", "url": "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html" }, { "title": "MISC", "url": "http://www.insecure.cl/Beast-SSL.rar" }, { "title": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006" }, { "title": "MS", "url": "http://technet.microsoft.com/security/bulletin/MS12-006" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html" }, { "title": "OSVDB", "url": "http://osvdb.org/74829" }, { "title": "Oval Security", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=737506" }, { "title": "RedHat Security Advisory", "url": "http://rhn.redhat.com/errata/RHSA-2012-0508.html" }, { "title": "RedHat Security Advisory", "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/45791" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/47998" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48256" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48692" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48915" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/48948" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/49198" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55322" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55350" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55351" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/49388" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/49778" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id?1025997" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id?1026103" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id?1026704" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id/1029190" }, { "title": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html" }, { "title": "SUSE", "url": "https://hermes.opensuse.org/messages/13154861" }, { "title": "SUSE", "url": "https://hermes.opensuse.org/messages/13155432" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3389" }, { "title": "Ubuntu Security Advisory", "url": "http://www.ubuntu.com/usn/USN-1263-1" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Input Validation", "upgradePath": [], "version": "3.7.9-2" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2021-08-15T06:54:30.891546Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-01-03T16:32:46.712021Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "modificationTime": "2022-09-01T15:08:13.560274Z", "severity": "low" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `jbigkit` package and not the `jbigkit` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.\n## Remediation\nThere is no fixed version for `Debian:12` `jbigkit`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-9937)\n- [MISC](http://bugzilla.maptools.org/show_bug.cgi?id=2707)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Security Focus](http://www.securityfocus.com/bid/99304)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-9937)\n", "disclosureTime": "2017-06-26T12:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.49433", "probability": "0.00145" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6", "jbigkit/libjbig0@2.1-6.1" ], "id": "SNYK-DEBIAN12-JBIGKIT-1549085", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2017-9937" ], "CWE": [ "CWE-119" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:22.854729Z", "name": "jbigkit/libjbig0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "jbigkit", "patches": [], "publicationTime": "2017-06-26T12:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2017-9937" }, { "title": "MISC", "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2707" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/99304" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-9937" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-Bounds", "upgradePath": [], "version": "2.1-6.1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:54:44.918130Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2022-01-03T16:29:48.950383Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n", "disclosureTime": "2018-01-16T09:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.37283", "probability": "0.00090" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5support0@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-1549480", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-5709" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:29.255894Z", "name": "krb5/libkrb5support0", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2018-01-16T09:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-5709" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709" }, { "title": "GitHub Additional Information", "url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-08T01:07:03.929822Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-16T01:10:59.882525Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-08-17T11:02:12.574963Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.7, "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-23T13:44:06.372458Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n", "disclosureTime": "2023-08-07T19:15:09.840000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43695", "probability": "0.00111" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5support0@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-5825659", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-36054" ], "CWE": [ "CWE-824" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-09T01:10:57.894447Z", "name": "krb5/libkrb5support0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2023-08-08T01:06:33.373942Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-36054", "url": "https://security-tracker.debian.org/tracker/CVE-2023-36054" }, { "title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", "url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final" }, { "title": "https://web.mit.edu/kerberos/www/advisories/", "url": "https://web.mit.edu/kerberos/www/advisories/" }, { "title": "https://security.netapp.com/advisory/ntap-20230908-0004/", "url": "https://security.netapp.com/advisory/ntap-20230908-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access of Uninitialized Pointer", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:54:44.918130Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2022-01-03T16:29:48.950383Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n", "disclosureTime": "2018-01-16T09:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.37283", "probability": "0.00090" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libk5crypto3@1.20.1-2", "krb5/libkrb5support0@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-1549480", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-5709" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:29.255894Z", "name": "krb5/libkrb5support0", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2018-01-16T09:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-5709" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709" }, { "title": "GitHub Additional Information", "url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-08T01:07:03.929822Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-16T01:10:59.882525Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-08-17T11:02:12.574963Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.7, "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-23T13:44:06.372458Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n", "disclosureTime": "2023-08-07T19:15:09.840000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43695", "probability": "0.00111" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libk5crypto3@1.20.1-2", "krb5/libkrb5support0@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-5825659", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-36054" ], "CWE": [ "CWE-824" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-09T01:10:57.894447Z", "name": "krb5/libkrb5support0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2023-08-08T01:06:33.373942Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-36054", "url": "https://security-tracker.debian.org/tracker/CVE-2023-36054" }, { "title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", "url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final" }, { "title": "https://web.mit.edu/kerberos/www/advisories/", "url": "https://web.mit.edu/kerberos/www/advisories/" }, { "title": "https://security.netapp.com/advisory/ntap-20230908-0004/", "url": "https://security.netapp.com/advisory/ntap-20230908-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access of Uninitialized Pointer", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:54:44.918130Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2022-01-03T16:29:48.950383Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n", "disclosureTime": "2018-01-16T09:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.37283", "probability": "0.00090" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2", "krb5/libkrb5support0@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-1549480", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-5709" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:29.255894Z", "name": "krb5/libkrb5support0", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2018-01-16T09:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-5709" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709" }, { "title": "GitHub Additional Information", "url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-08T01:07:03.929822Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-16T01:10:59.882525Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-08-17T11:02:12.574963Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.7, "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-23T13:44:06.372458Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n", "disclosureTime": "2023-08-07T19:15:09.840000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43695", "probability": "0.00111" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2", "krb5/libkrb5support0@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-5825659", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-36054" ], "CWE": [ "CWE-824" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-09T01:10:57.894447Z", "name": "krb5/libkrb5support0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2023-08-08T01:06:33.373942Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-36054", "url": "https://security-tracker.debian.org/tracker/CVE-2023-36054" }, { "title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", "url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final" }, { "title": "https://web.mit.edu/kerberos/www/advisories/", "url": "https://web.mit.edu/kerberos/www/advisories/" }, { "title": "https://security.netapp.com/advisory/ntap-20230908-0004/", "url": "https://security.netapp.com/advisory/ntap-20230908-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access of Uninitialized Pointer", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:54:44.918130Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2022-01-03T16:29:48.950383Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n", "disclosureTime": "2018-01-16T09:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.37283", "probability": "0.00090" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libk5crypto3@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-1549480", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-5709" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:29.255894Z", "name": "krb5/libk5crypto3", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2018-01-16T09:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-5709" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709" }, { "title": "GitHub Additional Information", "url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-08T01:07:03.929822Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-16T01:10:59.882525Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-08-17T11:02:12.574963Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.7, "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-23T13:44:06.372458Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n", "disclosureTime": "2023-08-07T19:15:09.840000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43695", "probability": "0.00111" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libk5crypto3@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-5825659", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-36054" ], "CWE": [ "CWE-824" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-09T01:10:57.894447Z", "name": "krb5/libk5crypto3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2023-08-08T01:06:33.373942Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-36054", "url": "https://security-tracker.debian.org/tracker/CVE-2023-36054" }, { "title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", "url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final" }, { "title": "https://web.mit.edu/kerberos/www/advisories/", "url": "https://web.mit.edu/kerberos/www/advisories/" }, { "title": "https://security.netapp.com/advisory/ntap-20230908-0004/", "url": "https://security.netapp.com/advisory/ntap-20230908-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access of Uninitialized Pointer", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:54:44.918130Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2022-01-03T16:29:48.950383Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n", "disclosureTime": "2018-01-16T09:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.37283", "probability": "0.00090" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2", "krb5/libk5crypto3@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-1549480", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-5709" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:29.255894Z", "name": "krb5/libk5crypto3", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2018-01-16T09:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-5709" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709" }, { "title": "GitHub Additional Information", "url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-08T01:07:03.929822Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-16T01:10:59.882525Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-08-17T11:02:12.574963Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.7, "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-23T13:44:06.372458Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n", "disclosureTime": "2023-08-07T19:15:09.840000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43695", "probability": "0.00111" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2", "krb5/libk5crypto3@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-5825659", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-36054" ], "CWE": [ "CWE-824" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-09T01:10:57.894447Z", "name": "krb5/libk5crypto3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2023-08-08T01:06:33.373942Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-36054", "url": "https://security-tracker.debian.org/tracker/CVE-2023-36054" }, { "title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", "url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final" }, { "title": "https://web.mit.edu/kerberos/www/advisories/", "url": "https://web.mit.edu/kerberos/www/advisories/" }, { "title": "https://security.netapp.com/advisory/ntap-20230908-0004/", "url": "https://security.netapp.com/advisory/ntap-20230908-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access of Uninitialized Pointer", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:54:44.918130Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2022-01-03T16:29:48.950383Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n", "disclosureTime": "2018-01-16T09:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.37283", "probability": "0.00090" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-1549480", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-5709" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:29.255894Z", "name": "krb5/libkrb5-3", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2018-01-16T09:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-5709" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709" }, { "title": "GitHub Additional Information", "url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-08T01:07:03.929822Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-16T01:10:59.882525Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-08-17T11:02:12.574963Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.7, "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-23T13:44:06.372458Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n", "disclosureTime": "2023-08-07T19:15:09.840000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43695", "probability": "0.00111" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-5825659", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-36054" ], "CWE": [ "CWE-824" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-09T01:10:57.894447Z", "name": "krb5/libkrb5-3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2023-08-08T01:06:33.373942Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-36054", "url": "https://security-tracker.debian.org/tracker/CVE-2023-36054" }, { "title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", "url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final" }, { "title": "https://web.mit.edu/kerberos/www/advisories/", "url": "https://web.mit.edu/kerberos/www/advisories/" }, { "title": "https://security.netapp.com/advisory/ntap-20230908-0004/", "url": "https://security.netapp.com/advisory/ntap-20230908-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access of Uninitialized Pointer", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:54:44.918130Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2022-01-03T16:29:48.950383Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-5709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709)\n- [GitHub Additional Information](https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709)\n", "disclosureTime": "2018-01-16T09:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.37283", "probability": "0.00090" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-1549480", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-5709" ], "CWE": [ "CWE-190" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:29.255894Z", "name": "krb5/libgssapi-krb5-2", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2018-01-16T09:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-5709" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709" }, { "title": "GitHub Additional Information", "url": "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Integer Overflow or Wraparound", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-08T01:07:03.929822Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-16T01:10:59.882525Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-08-17T11:02:12.574963Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.7, "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-23T13:44:06.372458Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.\n## Remediation\nThere is no fixed version for `Debian:12` `krb5`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-36054)\n- [cve@mitre.org](https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final)\n- [cve@mitre.org](https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final)\n- [cve@mitre.org](https://web.mit.edu/kerberos/www/advisories/)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230908-0004/)\n", "disclosureTime": "2023-08-07T19:15:09.840000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43695", "probability": "0.00111" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2" ], "id": "SNYK-DEBIAN12-KRB5-5825659", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-36054" ], "CWE": [ "CWE-824" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-09T01:10:57.894447Z", "name": "krb5/libgssapi-krb5-2", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "krb5", "patches": [], "publicationTime": "2023-08-08T01:06:33.373942Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-36054", "url": "https://security-tracker.debian.org/tracker/CVE-2023-36054" }, { "title": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd", "url": "https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final" }, { "title": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final", "url": "https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final" }, { "title": "https://web.mit.edu/kerberos/www/advisories/", "url": "https://web.mit.edu/kerberos/www/advisories/" }, { "title": "https://security.netapp.com/advisory/ntap-20230908-0004/", "url": "https://security.netapp.com/advisory/ntap-20230908-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access of Uninitialized Pointer", "upgradePath": [], "version": "1.20.1-2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2023-03-16T00:48:43.187167Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modificationTime": "2023-03-18T01:10:14.985127Z", "severity": "high" } ], "cvssScore": 8.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libde265` package and not the `libde265` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc.\n## Remediation\nThere is no fixed version for `Debian:12` `libde265`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-27103)\n- [cve@mitre.org](https://github.com/strukturag/libde265/issues/394)\n", "disclosureTime": "2023-03-15T15:15:09.670000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.36047", "probability": "0.00087" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libheif/libheif1@1.15.1-1", "libde265/libde265-0@1.0.11-1" ], "id": "SNYK-DEBIAN12-LIBDE265-3361563", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-27103" ], "CWE": [ "CWE-787" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-24T00:46:32.091965Z", "name": "libde265/libde265-0", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "libde265", "patches": [], "publicationTime": "2023-03-16T00:48:43.153153Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-27103" }, { "title": "cve@mitre.org", "url": "https://github.com/strukturag/libde265/issues/394" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-bounds Write", "upgradePath": [], "version": "1.0.11-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-03-16T00:49:53.520020Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-03-21T01:10:09.465225Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libde265` package and not the `libde265` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx.cc.\n## Remediation\nThere is no fixed version for `Debian:12` `libde265`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-27102)\n- [cve@mitre.org](https://github.com/strukturag/libde265/issues/393)\n", "disclosureTime": "2023-03-15T15:15:09.617000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.14013", "probability": "0.00046" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libheif/libheif1@1.15.1-1", "libde265/libde265-0@1.0.11-1" ], "id": "SNYK-DEBIAN12-LIBDE265-3361567", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-27102" ], "CWE": [ "CWE-476" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-24T00:46:19.394399Z", "name": "libde265/libde265-0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "libde265", "patches": [], "publicationTime": "2023-03-16T00:48:48.784025Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-27102" }, { "title": "cve@mitre.org", "url": "https://github.com/strukturag/libde265/issues/393" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "NULL Pointer Dereference", "upgradePath": [], "version": "1.0.11-1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:55:11.810107Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-09-01T21:30:15.963323Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-01-03T16:30:47.839471Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libgcrypt20` package and not the `libgcrypt20` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.\n## Remediation\nThere is no fixed version for `Debian:12` `libgcrypt20`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-6829)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki)\n- [MISC](https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html)\n- [MISC](https://www.oracle.com/security-alerts/cpujan2020.html)\n", "disclosureTime": "2018-02-07T23:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.55484", "probability": "0.00191" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "libgcrypt20@1.10.1-3" ], "id": "SNYK-DEBIAN12-LIBGCRYPT20-1550206", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-6829" ], "CWE": [ "CWE-327" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:28.786599Z", "name": "libgcrypt20", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "libgcrypt20", "patches": [], "publicationTime": "2018-02-07T23:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-6829" }, { "title": "MISC", "url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal" }, { "title": "MISC", "url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki" }, { "title": "MISC", "url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html" }, { "title": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Use of a Broken or Risky Cryptographic Algorithm", "upgradePath": [], "version": "1.10.1-3" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:55:11.810107Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-09-01T21:30:15.963323Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-01-03T16:30:47.839471Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libgcrypt20` package and not the `libgcrypt20` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.\n## Remediation\nThere is no fixed version for `Debian:12` `libgcrypt20`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-6829)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki)\n- [MISC](https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html)\n- [MISC](https://www.oracle.com/security-alerts/cpujan2020.html)\n", "disclosureTime": "2018-02-07T23:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.55484", "probability": "0.00191" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "gnupg2/gpgv@2.2.40-1.1", "libgcrypt20@1.10.1-3" ], "id": "SNYK-DEBIAN12-LIBGCRYPT20-1550206", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-6829" ], "CWE": [ "CWE-327" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:28.786599Z", "name": "libgcrypt20", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "libgcrypt20", "patches": [], "publicationTime": "2018-02-07T23:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-6829" }, { "title": "MISC", "url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal" }, { "title": "MISC", "url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki" }, { "title": "MISC", "url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html" }, { "title": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Use of a Broken or Risky Cryptographic Algorithm", "upgradePath": [], "version": "1.10.1-3" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:55:11.810107Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-09-01T21:30:15.963323Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-01-03T16:30:47.839471Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libgcrypt20` package and not the `libgcrypt20` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.\n## Remediation\nThere is no fixed version for `Debian:12` `libgcrypt20`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-6829)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki)\n- [MISC](https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html)\n- [MISC](https://www.oracle.com/security-alerts/cpujan2020.html)\n", "disclosureTime": "2018-02-07T23:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.55484", "probability": "0.00191" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-xslt@1.25.2-1~bookworm", "libxslt/libxslt1.1@1.1.35-1", "libgcrypt20@1.10.1-3" ], "id": "SNYK-DEBIAN12-LIBGCRYPT20-1550206", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-6829" ], "CWE": [ "CWE-327" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:28.786599Z", "name": "libgcrypt20", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "libgcrypt20", "patches": [], "publicationTime": "2018-02-07T23:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-6829" }, { "title": "MISC", "url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal" }, { "title": "MISC", "url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki" }, { "title": "MISC", "url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html" }, { "title": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Use of a Broken or Risky Cryptographic Algorithm", "upgradePath": [], "version": "1.10.1-3" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:55:11.810107Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-09-01T21:30:15.963323Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-01-03T16:30:47.839471Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libgcrypt20` package and not the `libgcrypt20` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.\n## Remediation\nThere is no fixed version for `Debian:12` `libgcrypt20`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-6829)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal)\n- [MISC](https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki)\n- [MISC](https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html)\n- [MISC](https://www.oracle.com/security-alerts/cpujan2020.html)\n", "disclosureTime": "2018-02-07T23:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.55484", "probability": "0.00191" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "systemd/libsystemd0@252.12-1~deb12u1", "libgcrypt20@1.10.1-3" ], "id": "SNYK-DEBIAN12-LIBGCRYPT20-1550206", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-6829" ], "CWE": [ "CWE-327" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:28.786599Z", "name": "libgcrypt20", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "libgcrypt20", "patches": [], "publicationTime": "2018-02-07T23:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-6829" }, { "title": "MISC", "url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal" }, { "title": "MISC", "url": "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki" }, { "title": "MISC", "url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html" }, { "title": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Use of a Broken or Risky Cryptographic Algorithm", "upgradePath": [], "version": "1.10.1-3" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-05-06T12:50:25.956095Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-05-12T01:10:17.979784Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-05-17T11:01:57.348399Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libheif` package and not the `libheif` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `libheif`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-29659)\n- [cve@mitre.org](https://github.com/strukturag/libheif/issues/794)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L/)\n", "disclosureTime": "2023-05-05T16:15:09.387000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.15557", "probability": "0.00049" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libheif/libheif1@1.15.1-1" ], "id": "SNYK-DEBIAN12-LIBHEIF-5498469", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-29659" ], "CWE": [ "CWE-369" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-24T00:46:24.190029Z", "name": "libheif/libheif1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "libheif", "patches": [], "publicationTime": "2023-05-06T12:49:49.736256Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-29659" }, { "title": "cve@mitre.org", "url": "https://github.com/strukturag/libheif/issues/794" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAE6NQBA3Q7GS6VTNDZRZZZVPPEFUEZ/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGKHDCS4HRZE3UGXYYDYPTIPNIBRLQ5L/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Divide By Zero", "upgradePath": [], "version": "1.15.1-1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-01-26T14:01:16.081543Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-09-01T22:16:05.689251Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-08T13:10:48.367003Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libpng1.6` package and not the `libpng1.6` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `libpng1.6`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2021-4214)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2043393)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2021-4214)\n- [secalert@redhat.com](https://github.com/glennrp/libpng/issues/302)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20221020-0001/)\n", "disclosureTime": "2022-08-24T16:15:10.037000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libpng1.6/libpng16-16@1.6.39-2" ], "id": "SNYK-DEBIAN12-LIBPNG16-2363910", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2021-4214" ], "CWE": [ "CWE-120" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:39:16.431777Z", "name": "libpng1.6/libpng16-16", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "libpng1.6", "patches": [], "publicationTime": "2022-01-26T14:01:16.064630Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2021-4214" }, { "title": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2043393" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2021-4214" }, { "title": "secalert@redhat.com", "url": "https://github.com/glennrp/libpng/issues/302" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20221020-0001/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Buffer Overflow", "upgradePath": [], "version": "1.6.39-2" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-01-26T14:01:16.081543Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-09-01T22:16:05.689251Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-08T13:10:48.367003Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libpng1.6` package and not the `libpng1.6` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `libpng1.6`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2021-4214)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2043393)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2021-4214)\n- [secalert@redhat.com](https://github.com/glennrp/libpng/issues/302)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20221020-0001/)\n", "disclosureTime": "2022-08-24T16:15:10.037000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "fontconfig/libfontconfig1@2.14.1-4", "freetype/libfreetype6@2.12.1+dfsg-5", "libpng1.6/libpng16-16@1.6.39-2" ], "id": "SNYK-DEBIAN12-LIBPNG16-2363910", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2021-4214" ], "CWE": [ "CWE-120" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:39:16.431777Z", "name": "libpng1.6/libpng16-16", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "libpng1.6", "patches": [], "publicationTime": "2022-01-26T14:01:16.064630Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2021-4214" }, { "title": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2043393" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2021-4214" }, { "title": "secalert@redhat.com", "url": "https://github.com/glennrp/libpng/issues/302" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20221020-0001/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Buffer Overflow", "upgradePath": [], "version": "1.6.39-2" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-09-13T01:35:18.712992Z", "credit": [ "" ], "cvssDetails": [], "cvssScore": null, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libwebp` package and not the `libwebp` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nHeap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)\n## Remediation\nThere is no fixed version for `Debian:12` `libwebp`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4863)\n- [chrome-cve-admin@google.com](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html)\n- [chrome-cve-admin@google.com](https://crbug.com/1479274)\n", "disclosureTime": "2023-09-12T15:15:24.327000Z", "epssDetails": null, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "libwebp/libwebp7@1.2.4-0.2" ], "id": "SNYK-DEBIAN12-LIBWEBP-5893095", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-4863" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-13T01:35:18.713030Z", "name": "libwebp/libwebp7", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "libwebp", "patches": [], "publicationTime": "2023-09-12T12:27:16.594261Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-4863", "url": "https://security-tracker.debian.org/tracker/CVE-2023-4863" }, { "title": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html", "url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html" }, { "title": "https://crbug.com/1479274", "url": "https://crbug.com/1479274" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-4863", "upgradePath": [], "version": "1.2.4-0.2" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-09-13T01:35:18.712992Z", "credit": [ "" ], "cvssDetails": [], "cvssScore": null, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libwebp` package and not the `libwebp` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nHeap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)\n## Remediation\nThere is no fixed version for `Debian:12` `libwebp`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4863)\n- [chrome-cve-admin@google.com](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html)\n- [chrome-cve-admin@google.com](https://crbug.com/1479274)\n", "disclosureTime": "2023-09-12T15:15:24.327000Z", "epssDetails": null, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6", "libwebp/libwebp7@1.2.4-0.2" ], "id": "SNYK-DEBIAN12-LIBWEBP-5893095", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-4863" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-13T01:35:18.713030Z", "name": "libwebp/libwebp7", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "libwebp", "patches": [], "publicationTime": "2023-09-12T12:27:16.594261Z", "references": [ { "title": "https://security-tracker.debian.org/tracker/CVE-2023-4863", "url": "https://security-tracker.debian.org/tracker/CVE-2023-4863" }, { "title": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html", "url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html" }, { "title": "https://crbug.com/1479274", "url": "https://crbug.com/1479274" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-4863", "upgradePath": [], "version": "1.2.4-0.2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-30T13:16:28.527232Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-09-01T01:11:04.392367Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxml2` package and not the `libxml2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nXmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.\n## Remediation\nThere is no fixed version for `Debian:12` `libxml2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39615)\n- [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/535)\n", "disclosureTime": "2023-08-29T17:15:12.527000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.23726", "probability": "0.00061" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-njs@1.25.2+0.8.0-1~bookworm", "libxml2@2.9.14+dfsg-1.3~deb12u1" ], "id": "SNYK-DEBIAN12-LIBXML2-5871333", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-39615" ], "CWE": [ "CWE-119" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-01T01:18:59.773572Z", "name": "libxml2", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "libxml2", "patches": [], "publicationTime": "2023-08-30T13:15:54.913292Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-39615" }, { "title": "cve@mitre.org", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/535" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-Bounds", "upgradePath": [], "version": "2.9.14+dfsg-1.3~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-30T13:16:28.527232Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-09-01T01:11:04.392367Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxml2` package and not the `libxml2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nXmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.\n## Remediation\nThere is no fixed version for `Debian:12` `libxml2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39615)\n- [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/535)\n", "disclosureTime": "2023-08-29T17:15:12.527000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.23726", "probability": "0.00061" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-xslt@1.25.2-1~bookworm", "libxml2@2.9.14+dfsg-1.3~deb12u1" ], "id": "SNYK-DEBIAN12-LIBXML2-5871333", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-39615" ], "CWE": [ "CWE-119" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-01T01:18:59.773572Z", "name": "libxml2", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "libxml2", "patches": [], "publicationTime": "2023-08-30T13:15:54.913292Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-39615" }, { "title": "cve@mitre.org", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/535" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-Bounds", "upgradePath": [], "version": "2.9.14+dfsg-1.3~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-08-30T13:16:28.527232Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-09-01T01:11:04.392367Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxml2` package and not the `libxml2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nXmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.\n## Remediation\nThere is no fixed version for `Debian:12` `libxml2`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-39615)\n- [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/535)\n", "disclosureTime": "2023-08-29T17:15:12.527000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.23726", "probability": "0.00061" }, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-xslt@1.25.2-1~bookworm", "libxslt/libxslt1.1@1.1.35-1", "libxml2@2.9.14+dfsg-1.3~deb12u1" ], "id": "SNYK-DEBIAN12-LIBXML2-5871333", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-39615" ], "CWE": [ "CWE-119" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-01T01:18:59.773572Z", "name": "libxml2", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "libxml2", "patches": [], "publicationTime": "2023-08-30T13:15:54.913292Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-39615" }, { "title": "cve@mitre.org", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/535" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-Bounds", "upgradePath": [], "version": "2.9.14+dfsg-1.3~deb12u1" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:55:50.232557Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "modificationTime": "2022-01-03T17:48:23.055640Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4, "cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "modificationTime": "2022-09-01T14:07:16.538563Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libxslt` package and not the `libxslt` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.\n## Remediation\nThere is no fixed version for `Debian:12` `libxslt`.\n## References\n- [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2015-9019)\n- [https://bugzilla.gnome.org/show_bug.cgi?id=758400](https://bugzilla.gnome.org/show_bug.cgi?id=758400)\n- [https://bugzilla.suse.com/show_bug.cgi?id=934119](https://bugzilla.suse.com/show_bug.cgi?id=934119)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-9019)\n", "disclosureTime": "2017-04-05T21:59:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.23501", "probability": "0.00060" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-xslt@1.25.2-1~bookworm", "libxslt/libxslt1.1@1.1.35-1" ], "id": "SNYK-DEBIAN12-LIBXSLT-1551290", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2015-9019" ], "CWE": [ "CWE-330" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:22.185766Z", "name": "libxslt/libxslt1.1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "libxslt", "patches": [], "publicationTime": "2017-04-05T21:59:00Z", "references": [ { "title": "Debian Security Tracker", "url": "https://security-tracker.debian.org/tracker/CVE-2015-9019" }, { "title": "https://bugzilla.gnome.org/show_bug.cgi?id=758400", "url": "https://bugzilla.gnome.org/show_bug.cgi?id=758400" }, { "title": "https://bugzilla.suse.com/show_bug.cgi?id=934119", "url": "https://bugzilla.suse.com/show_bug.cgi?id=934119" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-9019" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Use of Insufficiently Random Values", "upgradePath": [], "version": "1.1.35-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:57:51.371636Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.803353Z", "severity": "medium" } ], "cvssScore": 6.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n", "disclosureTime": "2010-01-13T20:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.76795", "probability": "0.00662" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1554675", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2009-4487" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:39.297372Z", "name": "nginx", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2010-01-13T20:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2009-4487" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded" }, { "title": "MISC", "url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/37711" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2009-4487", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:58:04.469498Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.620032Z", "severity": "high" } ], "cvssScore": 7.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n", "disclosureTime": "2013-10-27T00:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.55777", "probability": "0.00192" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1555042", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-0337" ], "CWE": [ "CWE-264" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-03-16T13:13:06.615055Z", "name": "nginx", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2013-10-27T00:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-0337" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201310-04.xml" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/21/15" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/22/1" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/24/1" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55181" } ], "relativeImportance": "low", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access Restriction Bypass", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:57:51.371636Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.803353Z", "severity": "medium" } ], "cvssScore": 6.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n", "disclosureTime": "2010-01-13T20:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.76795", "probability": "0.00662" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-geoip@1.25.2-1~bookworm", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1554675", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2009-4487" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:39.297372Z", "name": "nginx", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2010-01-13T20:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2009-4487" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded" }, { "title": "MISC", "url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/37711" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2009-4487", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:58:04.469498Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.620032Z", "severity": "high" } ], "cvssScore": 7.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n", "disclosureTime": "2013-10-27T00:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.55777", "probability": "0.00192" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-geoip@1.25.2-1~bookworm", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1555042", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-0337" ], "CWE": [ "CWE-264" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-03-16T13:13:06.615055Z", "name": "nginx", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2013-10-27T00:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-0337" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201310-04.xml" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/21/15" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/22/1" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/24/1" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55181" } ], "relativeImportance": "low", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access Restriction Bypass", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:57:51.371636Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.803353Z", "severity": "medium" } ], "cvssScore": 6.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n", "disclosureTime": "2010-01-13T20:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.76795", "probability": "0.00662" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1554675", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2009-4487" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:39.297372Z", "name": "nginx", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2010-01-13T20:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2009-4487" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded" }, { "title": "MISC", "url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/37711" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2009-4487", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:58:04.469498Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.620032Z", "severity": "high" } ], "cvssScore": 7.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n", "disclosureTime": "2013-10-27T00:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.55777", "probability": "0.00192" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1555042", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-0337" ], "CWE": [ "CWE-264" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-03-16T13:13:06.615055Z", "name": "nginx", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2013-10-27T00:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-0337" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201310-04.xml" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/21/15" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/22/1" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/24/1" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55181" } ], "relativeImportance": "low", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access Restriction Bypass", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:57:51.371636Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.803353Z", "severity": "medium" } ], "cvssScore": 6.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n", "disclosureTime": "2010-01-13T20:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.76795", "probability": "0.00662" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-njs@1.25.2+0.8.0-1~bookworm", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1554675", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2009-4487" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:39.297372Z", "name": "nginx", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2010-01-13T20:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2009-4487" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded" }, { "title": "MISC", "url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/37711" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2009-4487", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:58:04.469498Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.620032Z", "severity": "high" } ], "cvssScore": 7.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n", "disclosureTime": "2013-10-27T00:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.55777", "probability": "0.00192" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-njs@1.25.2+0.8.0-1~bookworm", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1555042", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-0337" ], "CWE": [ "CWE-264" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-03-16T13:13:06.615055Z", "name": "nginx", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2013-10-27T00:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-0337" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201310-04.xml" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/21/15" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/22/1" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/24/1" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55181" } ], "relativeImportance": "low", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access Restriction Bypass", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:57:51.371636Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.803353Z", "severity": "medium" } ], "cvssScore": 6.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2009-4487)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/508830/100/0/threaded)\n- [MISC](http://www.ush.it/team/ush/hack_httpd_escape/adv.txt)\n- [Security Focus](http://www.securityfocus.com/bid/37711)\n", "disclosureTime": "2010-01-13T20:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.76795", "probability": "0.00662" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-xslt@1.25.2-1~bookworm", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1554675", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2009-4487" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:39.297372Z", "name": "nginx", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2010-01-13T20:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2009-4487" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded" }, { "title": "MISC", "url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/37711" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2009-4487", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cpes": [], "creationTime": "2021-08-15T06:58:04.469498Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "modificationTime": "2023-02-09T11:24:34.620032Z", "severity": "high" } ], "cvssScore": 7.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nginx` package and not the `nginx` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.\n## Remediation\nThere is no fixed version for `Debian:12` `nginx`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-0337)\n- [Gentoo Security Advisory](http://security.gentoo.org/glsa/glsa-201310-04.xml)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/21/15)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/22/1)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/02/24/1)\n- [Secunia Advisory](http://secunia.com/advisories/55181)\n", "disclosureTime": "2013-10-27T00:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.55777", "probability": "0.00192" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-xslt@1.25.2-1~bookworm", "nginx@1.25.2-1~bookworm" ], "id": "SNYK-DEBIAN12-NGINX-1555042", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-0337" ], "CWE": [ "CWE-264" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-03-16T13:13:06.615055Z", "name": "nginx", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "nginx", "patches": [], "publicationTime": "2013-10-27T00:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-0337" }, { "title": "Gentoo Security Advisory", "url": "http://security.gentoo.org/glsa/glsa-201310-04.xml" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/21/15" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/22/1" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/02/24/1" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/55181" } ], "relativeImportance": "low", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access Restriction Bypass", "upgradePath": [], "version": "1.25.2-1~bookworm" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2021-08-15T06:58:26.416725Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.7, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-06-14T01:10:55.829010Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-09-01T20:47:11.884186Z", "severity": "medium" } ], "cvssScore": 4.7, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nslapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-14159)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14159)\n- [MISC](http://www.openldap.org/its/index.cgi?findid=8703)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-14159)\n- [cve@mitre.org](https://www.oracle.com/security-alerts/cpuapr2022.html)\n", "disclosureTime": "2017-09-05T18:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07859", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openldap/libldap-2.5-0@2.5.13+dfsg-5" ], "id": "SNYK-DEBIAN12-OPENLDAP-1555631", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2017-14159" ], "CWE": [ "CWE-665" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T14:06:15.016689Z", "name": "openldap/libldap-2.5-0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openldap", "patches": [], "publicationTime": "2017-09-05T18:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2017-14159" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14159" }, { "title": "MISC", "url": "http://www.openldap.org/its/index.cgi?findid=8703" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-14159" }, { "title": "cve@mitre.org", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Initialization", "upgradePath": [], "version": "2.5.13+dfsg-5" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2021-08-15T06:58:29.662198Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-06-14T01:10:53.087460Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-09-01T20:53:03.150085Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-05-04T00:09:08.207615Z", "severity": "medium" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ncontrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-17740)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17740)\n- [MISC](http://www.openldap.org/its/index.cgi/Incoming?id=8759)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html)\n- [cve@mitre.org](https://kc.mcafee.com/corporate/index?page=content&id=SB10365)\n- [cve@mitre.org](https://www.oracle.com/security-alerts/cpuapr2022.html)\n", "disclosureTime": "2017-12-18T06:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.70157", "probability": "0.00407" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openldap/libldap-2.5-0@2.5.13+dfsg-5" ], "id": "SNYK-DEBIAN12-OPENLDAP-1555724", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2017-17740" ], "CWE": [ "CWE-119" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T14:07:38.956852Z", "name": "openldap/libldap-2.5-0", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "openldap", "patches": [], "publicationTime": "2017-12-18T06:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2017-17740" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17740" }, { "title": "MISC", "url": "http://www.openldap.org/its/index.cgi/Incoming?id=8759" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html" }, { "title": "cve@mitre.org", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10365" }, { "title": "cve@mitre.org", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-Bounds", "upgradePath": [], "version": "2.5.13+dfsg-5" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:38.494586Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.2, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2022-05-13T01:11:01.289386Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 4.2, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2022-05-03T23:05:21.716502Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.2, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2022-09-01T15:57:53.712715Z", "severity": "medium" } ], "cvssScore": 4.2, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2020-15719)\n- [MISC](https://access.redhat.com/errata/RHBA-2019:3674)\n- [MISC](https://bugs.openldap.org/show_bug.cgi?id=9266)\n- [MISC](https://bugzilla.redhat.com/show_bug.cgi?id=1740070)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html)\n- [SUSE](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html)\n- [cve@mitre.org](https://kc.mcafee.com/corporate/index?page=content&id=SB10365)\n- [cve@mitre.org](https://www.oracle.com/security-alerts/cpuapr2022.html)\n", "disclosureTime": "2020-07-14T14:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.50812", "probability": "0.00155" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openldap/libldap-2.5-0@2.5.13+dfsg-5" ], "id": "SNYK-DEBIAN12-OPENLDAP-1555918", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2020-15719" ], "CWE": [ "CWE-295" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:46:38.760074Z", "name": "openldap/libldap-2.5-0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openldap", "patches": [], "publicationTime": "2020-07-16T10:54:51.796172Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2020-15719" }, { "title": "MISC", "url": "https://access.redhat.com/errata/RHBA-2019:3674" }, { "title": "MISC", "url": "https://bugs.openldap.org/show_bug.cgi?id=9266" }, { "title": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1740070" }, { "title": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html" }, { "title": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html" }, { "title": "cve@mitre.org", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10365" }, { "title": "cve@mitre.org", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Certificate Validation", "upgradePath": [], "version": "2.5.13+dfsg-5" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:39.325104Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "modificationTime": "2023-02-09T11:24:56.007448Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2023-04-29T01:10:07.535565Z", "severity": "high" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2015-3276)\n- [Oracle Security Bulletin](http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1238322)\n- [RedHat Security Advisory](http://rhn.redhat.com/errata/RHSA-2015-2131.html)\n- [Security Tracker](http://www.securitytracker.com/id/1034221)\n- [secalert@redhat.com](https://access.redhat.com/errata/RHSA-2015:2131)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2015-3276)\n", "disclosureTime": "2015-12-07T20:59:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.63219", "probability": "0.00271" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openldap/libldap-2.5-0@2.5.13+dfsg-5" ], "id": "SNYK-DEBIAN12-OPENLDAP-1555941", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2015-3276" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-04-29T01:10:07.535565Z", "name": "openldap/libldap-2.5-0", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "openldap", "patches": [], "publicationTime": "2015-12-07T20:59:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2015-3276" }, { "title": "Oracle Security Bulletin", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1238322" }, { "title": "RedHat Security Advisory", "url": "http://rhn.redhat.com/errata/RHSA-2015-2131.html" }, { "title": "Security Tracker", "url": "http://www.securitytracker.com/id/1034221" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2015:2131" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2015-3276" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "2.5.13+dfsg-5" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-05-30T13:15:51.722655Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 7.1, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "modificationTime": "2023-06-20T13:42:33.283208Z", "severity": "high" }, { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-06-07T01:10:13.825709Z", "severity": "high" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-06-13T11:03:11.422027Z", "severity": "medium" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openldap` package and not the `openldap` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.\n## Remediation\nThere is no fixed version for `Debian:12` `openldap`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2953)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-2953)\n- [secalert@redhat.com](https://bugs.openldap.org/show_bug.cgi?id=9904)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230703-0005/)\n- [secalert@redhat.com](https://support.apple.com/kb/HT213843)\n- [secalert@redhat.com](https://support.apple.com/kb/HT213844)\n- [secalert@redhat.com](https://support.apple.com/kb/HT213845)\n- [secalert@redhat.com](http://seclists.org/fulldisclosure/2023/Jul/47)\n- [secalert@redhat.com](http://seclists.org/fulldisclosure/2023/Jul/48)\n- [secalert@redhat.com](http://seclists.org/fulldisclosure/2023/Jul/52)\n", "disclosureTime": "2023-05-30T22:15:10.613000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.63025", "probability": "0.00263" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openldap/libldap-2.5-0@2.5.13+dfsg-5" ], "id": "SNYK-DEBIAN12-OPENLDAP-5660620", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-2953" ], "CWE": [ "CWE-476" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-03T01:10:56.480285Z", "name": "openldap/libldap-2.5-0", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "openldap", "patches": [], "publicationTime": "2023-05-30T13:15:45.096477Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-2953" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2023-2953" }, { "title": "secalert@redhat.com", "url": "https://bugs.openldap.org/show_bug.cgi?id=9904" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20230703-0005/" }, { "title": "secalert@redhat.com", "url": "https://support.apple.com/kb/HT213843" }, { "title": "secalert@redhat.com", "url": "https://support.apple.com/kb/HT213844" }, { "title": "secalert@redhat.com", "url": "https://support.apple.com/kb/HT213845" }, { "title": "secalert@redhat.com", "url": "http://seclists.org/fulldisclosure/2023/Jul/47" }, { "title": "secalert@redhat.com", "url": "http://seclists.org/fulldisclosure/2023/Jul/48" }, { "title": "secalert@redhat.com", "url": "http://seclists.org/fulldisclosure/2023/Jul/52" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "NULL Pointer Dereference", "upgradePath": [], "version": "2.5.13+dfsg-5" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:34.862585Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:53.890325Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:00.865086Z", "severity": "medium" } ], "cvssScore": 5.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n", "disclosureTime": "2013-10-11T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75770", "probability": "0.00614" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx@1.25.2-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555825", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-6755" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:20.838611Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2013-10-11T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-6755" }, { "title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", "url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/" }, { "title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", "url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html" }, { "title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", "url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html" }, { "title": "http://rump2007.cr.yp.to/15-shumow.pdf", "url": "http://rump2007.cr.yp.to/15-shumow.pdf" }, { "title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", "url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/" }, { "title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html", "url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html" }, { "title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", "url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/63657" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:38.130437Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:59.868606Z", "severity": "medium" } ], "cvssScore": 5.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n", "disclosureTime": "2010-03-05T19:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.24420", "probability": "0.00062" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx@1.25.2-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555907", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2010-0928" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:38.644692Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2010-03-05T19:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2010-0928" }, { "title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/", "url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/" }, { "title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf", "url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf" }, { "title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html", "url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html" }, { "title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/", "url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/" }, { "title": "http://xforce.iss.net/xforce/xfdb/56750", "url": "http://xforce.iss.net/xforce/xfdb/56750" }, { "title": "X-force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-07-15T01:59:11.923863Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-07-27T13:11:18.639951Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2023-07-29T11:06:24.174701Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:32:55.795420Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n", "disclosureTime": "2023-07-14T12:15:09.023000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.64083", "probability": "0.00278" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx@1.25.2-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5776700", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-2975" ], "CWE": [ "CWE-287" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:32:55.795420Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-15T01:56:47.741607Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-2975" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230714.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/15/1" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230725-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Authentication", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-07-20T01:50:10.257559Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-25T13:32:17.801774Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-26T11:03:32.344082Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-29T01:10:57.595980Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n", "disclosureTime": "2023-07-19T12:15:10.003000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51722", "probability": "0.00159" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx@1.25.2-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5788322", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3446" ], "CWE": [ "CWE-1333" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-16T13:10:45.831768Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-20T01:50:10.235107Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3446" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230719.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/4" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/6" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230803-0011/" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Inefficient Regular Expression Complexity", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-08-01T13:45:07.815112Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:31:51.629782Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T01:12:10.245558Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T11:03:42.422326Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n", "disclosureTime": "2023-07-31T16:15:10.497000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43243", "probability": "0.00109" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx@1.25.2-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5812633", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3817" ], "CWE": [ "CWE-834" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-19T01:10:44.145109Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-08-01T13:44:38.433704Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3817" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230731.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "http://seclists.org/fulldisclosure/2023/Jul/43" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230818-0014/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Excessive Iteration", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:34.862585Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:53.890325Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:00.865086Z", "severity": "medium" } ], "cvssScore": 5.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n", "disclosureTime": "2013-10-11T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75770", "probability": "0.00614" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-njs@1.25.2+0.8.0-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555825", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-6755" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:20.838611Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2013-10-11T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-6755" }, { "title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", "url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/" }, { "title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", "url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html" }, { "title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", "url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html" }, { "title": "http://rump2007.cr.yp.to/15-shumow.pdf", "url": "http://rump2007.cr.yp.to/15-shumow.pdf" }, { "title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", "url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/" }, { "title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html", "url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html" }, { "title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", "url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/63657" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:38.130437Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:59.868606Z", "severity": "medium" } ], "cvssScore": 5.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n", "disclosureTime": "2010-03-05T19:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.24420", "probability": "0.00062" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-njs@1.25.2+0.8.0-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555907", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2010-0928" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:38.644692Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2010-03-05T19:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2010-0928" }, { "title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/", "url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/" }, { "title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf", "url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf" }, { "title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html", "url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html" }, { "title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/", "url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/" }, { "title": "http://xforce.iss.net/xforce/xfdb/56750", "url": "http://xforce.iss.net/xforce/xfdb/56750" }, { "title": "X-force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-07-15T01:59:11.923863Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-07-27T13:11:18.639951Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2023-07-29T11:06:24.174701Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:32:55.795420Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n", "disclosureTime": "2023-07-14T12:15:09.023000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.64083", "probability": "0.00278" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-njs@1.25.2+0.8.0-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5776700", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-2975" ], "CWE": [ "CWE-287" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:32:55.795420Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-15T01:56:47.741607Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-2975" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230714.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/15/1" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230725-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Authentication", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-07-20T01:50:10.257559Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-25T13:32:17.801774Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-26T11:03:32.344082Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-29T01:10:57.595980Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n", "disclosureTime": "2023-07-19T12:15:10.003000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51722", "probability": "0.00159" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-njs@1.25.2+0.8.0-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5788322", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3446" ], "CWE": [ "CWE-1333" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-16T13:10:45.831768Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-20T01:50:10.235107Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3446" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230719.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/4" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/6" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230803-0011/" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Inefficient Regular Expression Complexity", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-08-01T13:45:07.815112Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:31:51.629782Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T01:12:10.245558Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T11:03:42.422326Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n", "disclosureTime": "2023-07-31T16:15:10.497000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43243", "probability": "0.00109" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-njs@1.25.2+0.8.0-1~bookworm", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5812633", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3817" ], "CWE": [ "CWE-834" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-19T01:10:44.145109Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-08-01T13:44:38.433704Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3817" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230731.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "http://seclists.org/fulldisclosure/2023/Jul/43" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230818-0014/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Excessive Iteration", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:34.862585Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:53.890325Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:00.865086Z", "severity": "medium" } ], "cvssScore": 5.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n", "disclosureTime": "2013-10-11T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75770", "probability": "0.00614" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555825", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-6755" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:20.838611Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2013-10-11T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-6755" }, { "title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", "url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/" }, { "title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", "url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html" }, { "title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", "url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html" }, { "title": "http://rump2007.cr.yp.to/15-shumow.pdf", "url": "http://rump2007.cr.yp.to/15-shumow.pdf" }, { "title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", "url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/" }, { "title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html", "url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html" }, { "title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", "url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/63657" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:38.130437Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:59.868606Z", "severity": "medium" } ], "cvssScore": 5.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n", "disclosureTime": "2010-03-05T19:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.24420", "probability": "0.00062" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555907", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2010-0928" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:38.644692Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2010-03-05T19:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2010-0928" }, { "title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/", "url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/" }, { "title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf", "url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf" }, { "title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html", "url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html" }, { "title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/", "url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/" }, { "title": "http://xforce.iss.net/xforce/xfdb/56750", "url": "http://xforce.iss.net/xforce/xfdb/56750" }, { "title": "X-force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-07-15T01:59:11.923863Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-07-27T13:11:18.639951Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2023-07-29T11:06:24.174701Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:32:55.795420Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n", "disclosureTime": "2023-07-14T12:15:09.023000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.64083", "probability": "0.00278" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5776700", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-2975" ], "CWE": [ "CWE-287" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:32:55.795420Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-15T01:56:47.741607Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-2975" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230714.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/15/1" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230725-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Authentication", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-07-20T01:50:10.257559Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-25T13:32:17.801774Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-26T11:03:32.344082Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-29T01:10:57.595980Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n", "disclosureTime": "2023-07-19T12:15:10.003000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51722", "probability": "0.00159" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5788322", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3446" ], "CWE": [ "CWE-1333" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-16T13:10:45.831768Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-20T01:50:10.235107Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3446" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230719.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/4" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/6" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230803-0011/" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Inefficient Regular Expression Complexity", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-08-01T13:45:07.815112Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:31:51.629782Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T01:12:10.245558Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T11:03:42.422326Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n", "disclosureTime": "2023-07-31T16:15:10.497000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43243", "probability": "0.00109" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5812633", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3817" ], "CWE": [ "CWE-834" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-19T01:10:44.145109Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-08-01T13:44:38.433704Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3817" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230731.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "http://seclists.org/fulldisclosure/2023/Jul/43" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230818-0014/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Excessive Iteration", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:34.862585Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:53.890325Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:00.865086Z", "severity": "medium" } ], "cvssScore": 5.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n", "disclosureTime": "2013-10-11T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75770", "probability": "0.00614" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555825", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-6755" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:20.838611Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2013-10-11T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-6755" }, { "title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", "url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/" }, { "title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", "url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html" }, { "title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", "url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html" }, { "title": "http://rump2007.cr.yp.to/15-shumow.pdf", "url": "http://rump2007.cr.yp.to/15-shumow.pdf" }, { "title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", "url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/" }, { "title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html", "url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html" }, { "title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", "url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/63657" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:38.130437Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:59.868606Z", "severity": "medium" } ], "cvssScore": 5.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n", "disclosureTime": "2010-03-05T19:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.24420", "probability": "0.00062" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555907", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2010-0928" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:38.644692Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2010-03-05T19:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2010-0928" }, { "title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/", "url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/" }, { "title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf", "url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf" }, { "title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html", "url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html" }, { "title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/", "url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/" }, { "title": "http://xforce.iss.net/xforce/xfdb/56750", "url": "http://xforce.iss.net/xforce/xfdb/56750" }, { "title": "X-force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-07-15T01:59:11.923863Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-07-27T13:11:18.639951Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2023-07-29T11:06:24.174701Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:32:55.795420Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n", "disclosureTime": "2023-07-14T12:15:09.023000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.64083", "probability": "0.00278" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5776700", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-2975" ], "CWE": [ "CWE-287" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:32:55.795420Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-15T01:56:47.741607Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-2975" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230714.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/15/1" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230725-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Authentication", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-07-20T01:50:10.257559Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-25T13:32:17.801774Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-26T11:03:32.344082Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-29T01:10:57.595980Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n", "disclosureTime": "2023-07-19T12:15:10.003000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51722", "probability": "0.00159" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5788322", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3446" ], "CWE": [ "CWE-1333" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-16T13:10:45.831768Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-20T01:50:10.235107Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3446" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230719.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/4" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/6" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230803-0011/" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Inefficient Regular Expression Complexity", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-08-01T13:45:07.815112Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:31:51.629782Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T01:12:10.245558Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T11:03:42.422326Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n", "disclosureTime": "2023-07-31T16:15:10.497000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43243", "probability": "0.00109" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5812633", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3817" ], "CWE": [ "CWE-834" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-19T01:10:44.145109Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-08-01T13:44:38.433704Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3817" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230731.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "http://seclists.org/fulldisclosure/2023/Jul/43" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230818-0014/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Excessive Iteration", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:34.862585Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:53.890325Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:00.865086Z", "severity": "medium" } ], "cvssScore": 5.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n", "disclosureTime": "2013-10-11T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75770", "probability": "0.00614" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "libssh2/libssh2-1@1.10.0-3+b1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555825", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-6755" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:20.838611Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2013-10-11T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-6755" }, { "title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", "url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/" }, { "title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", "url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html" }, { "title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", "url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html" }, { "title": "http://rump2007.cr.yp.to/15-shumow.pdf", "url": "http://rump2007.cr.yp.to/15-shumow.pdf" }, { "title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", "url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/" }, { "title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html", "url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html" }, { "title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", "url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/63657" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:38.130437Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:59.868606Z", "severity": "medium" } ], "cvssScore": 5.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n", "disclosureTime": "2010-03-05T19:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.24420", "probability": "0.00062" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "libssh2/libssh2-1@1.10.0-3+b1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555907", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2010-0928" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:38.644692Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2010-03-05T19:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2010-0928" }, { "title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/", "url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/" }, { "title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf", "url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf" }, { "title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html", "url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html" }, { "title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/", "url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/" }, { "title": "http://xforce.iss.net/xforce/xfdb/56750", "url": "http://xforce.iss.net/xforce/xfdb/56750" }, { "title": "X-force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-07-15T01:59:11.923863Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-07-27T13:11:18.639951Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2023-07-29T11:06:24.174701Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:32:55.795420Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n", "disclosureTime": "2023-07-14T12:15:09.023000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.64083", "probability": "0.00278" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "libssh2/libssh2-1@1.10.0-3+b1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5776700", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-2975" ], "CWE": [ "CWE-287" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:32:55.795420Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-15T01:56:47.741607Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-2975" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230714.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/15/1" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230725-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Authentication", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-07-20T01:50:10.257559Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-25T13:32:17.801774Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-26T11:03:32.344082Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-29T01:10:57.595980Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n", "disclosureTime": "2023-07-19T12:15:10.003000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51722", "probability": "0.00159" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "libssh2/libssh2-1@1.10.0-3+b1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5788322", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3446" ], "CWE": [ "CWE-1333" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-16T13:10:45.831768Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-20T01:50:10.235107Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3446" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230719.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/4" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/6" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230803-0011/" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Inefficient Regular Expression Complexity", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-08-01T13:45:07.815112Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:31:51.629782Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T01:12:10.245558Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T11:03:42.422326Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n", "disclosureTime": "2023-07-31T16:15:10.497000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43243", "probability": "0.00109" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "libssh2/libssh2-1@1.10.0-3+b1", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5812633", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3817" ], "CWE": [ "CWE-834" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-19T01:10:44.145109Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-08-01T13:44:38.433704Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3817" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230731.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "http://seclists.org/fulldisclosure/2023/Jul/43" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230818-0014/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Excessive Iteration", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:34.862585Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:53.890325Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:00.865086Z", "severity": "medium" } ], "cvssScore": 5.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n", "disclosureTime": "2013-10-11T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75770", "probability": "0.00614" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555825", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-6755" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:20.838611Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2013-10-11T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-6755" }, { "title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", "url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/" }, { "title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", "url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html" }, { "title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", "url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html" }, { "title": "http://rump2007.cr.yp.to/15-shumow.pdf", "url": "http://rump2007.cr.yp.to/15-shumow.pdf" }, { "title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", "url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/" }, { "title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html", "url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html" }, { "title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", "url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/63657" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:38.130437Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:59.868606Z", "severity": "medium" } ], "cvssScore": 5.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n", "disclosureTime": "2010-03-05T19:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.24420", "probability": "0.00062" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555907", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2010-0928" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:38.644692Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2010-03-05T19:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2010-0928" }, { "title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/", "url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/" }, { "title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf", "url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf" }, { "title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html", "url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html" }, { "title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/", "url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/" }, { "title": "http://xforce.iss.net/xforce/xfdb/56750", "url": "http://xforce.iss.net/xforce/xfdb/56750" }, { "title": "X-force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-07-15T01:59:11.923863Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-07-27T13:11:18.639951Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2023-07-29T11:06:24.174701Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:32:55.795420Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n", "disclosureTime": "2023-07-14T12:15:09.023000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.64083", "probability": "0.00278" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5776700", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-2975" ], "CWE": [ "CWE-287" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:32:55.795420Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-15T01:56:47.741607Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-2975" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230714.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/15/1" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230725-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Authentication", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-07-20T01:50:10.257559Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-25T13:32:17.801774Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-26T11:03:32.344082Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-29T01:10:57.595980Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n", "disclosureTime": "2023-07-19T12:15:10.003000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51722", "probability": "0.00159" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5788322", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3446" ], "CWE": [ "CWE-1333" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-16T13:10:45.831768Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-20T01:50:10.235107Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3446" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230719.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/4" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/6" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230803-0011/" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Inefficient Regular Expression Complexity", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-08-01T13:45:07.815112Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:31:51.629782Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T01:12:10.245558Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T11:03:42.422326Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n", "disclosureTime": "2023-07-31T16:15:10.497000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43243", "probability": "0.00109" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "curl@7.88.1-10+deb12u1", "curl/libcurl4@7.88.1-10+deb12u1", "krb5/libgssapi-krb5-2@1.20.1-2", "krb5/libkrb5-3@1.20.1-2", "openssl/libssl3@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5812633", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3817" ], "CWE": [ "CWE-834" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-19T01:10:44.145109Z", "name": "openssl/libssl3", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-08-01T13:44:38.433704Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3817" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230731.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "http://seclists.org/fulldisclosure/2023/Jul/43" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230818-0014/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Excessive Iteration", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:34.862585Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:53.890325Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:00.865086Z", "severity": "medium" } ], "cvssScore": 5.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-6755)\n- [http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/](http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/)\n- [http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html](http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html)\n- [http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html](http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html)\n- [http://rump2007.cr.yp.to/15-shumow.pdf](http://rump2007.cr.yp.to/15-shumow.pdf)\n- [http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/](http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/)\n- [https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html](https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html)\n- [http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect](http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect)\n- [Security Focus](http://www.securityfocus.com/bid/63657)\n", "disclosureTime": "2013-10-11T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75770", "probability": "0.00614" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555825", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-6755" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:20.838611Z", "name": "openssl", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2013-10-11T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-6755" }, { "title": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/", "url": "http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/" }, { "title": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html", "url": "http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html" }, { "title": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html", "url": "http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html" }, { "title": "http://rump2007.cr.yp.to/15-shumow.pdf", "url": "http://rump2007.cr.yp.to/15-shumow.pdf" }, { "title": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/", "url": "http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/" }, { "title": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html", "url": "https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html" }, { "title": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect", "url": "http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/63657" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:38.130437Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:59.868606Z", "severity": "medium" } ], "cvssScore": 5.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2010-0928)\n- [http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/](http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/)\n- [http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf](http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf)\n- [http://www.networkworld.com/news/2010/030410-rsa-security-attack.html](http://www.networkworld.com/news/2010/030410-rsa-security-attack.html)\n- [http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/](http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/)\n- [http://xforce.iss.net/xforce/xfdb/56750](http://xforce.iss.net/xforce/xfdb/56750)\n- [X-force Vulnerability Report](https://exchange.xforce.ibmcloud.com/vulnerabilities/56750)\n", "disclosureTime": "2010-03-05T19:30:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.24420", "probability": "0.00062" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-1555907", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2010-0928" ], "CWE": [ "CWE-310" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:38.644692Z", "name": "openssl", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2010-03-05T19:30:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2010-0928" }, { "title": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/", "url": "http://rdist.root.org/2010/03/08/attacking-rsa-exponentiation-with-fault-injection/" }, { "title": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf", "url": "http://www.eecs.umich.edu/%7Evaleria/research/publications/DATE10RSA.pdf" }, { "title": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html", "url": "http://www.networkworld.com/news/2010/030410-rsa-security-attack.html" }, { "title": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/", "url": "http://www.theregister.co.uk/2010/03/04/severe_openssl_vulnerability/" }, { "title": "http://xforce.iss.net/xforce/xfdb/56750", "url": "http://xforce.iss.net/xforce/xfdb/56750" }, { "title": "X-force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56750" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Cryptographic Issues", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-07-15T01:59:11.923863Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-07-27T13:11:18.639951Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.9, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2023-07-29T11:06:24.174701Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:32:55.795420Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be mislead by removing\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2975)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230714.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/15/1)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230725-0004/)\n", "disclosureTime": "2023-07-14T12:15:09.023000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.64083", "probability": "0.00278" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5776700", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-2975" ], "CWE": [ "CWE-287" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:32:55.795420Z", "name": "openssl", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-15T01:56:47.741607Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-2975" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=00e2f5eea29994d19293ec4e8c8775ba73678598" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230714.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/15/1" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230725-0004/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Authentication", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-07-20T01:50:10.257559Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-25T13:32:17.801774Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-26T11:03:32.344082Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-07-29T01:10:57.595980Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3446)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230719.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/4)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/5)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/19/6)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230803-0011/)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n", "disclosureTime": "2023-07-19T12:15:10.003000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.51722", "probability": "0.00159" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5788322", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3446" ], "CWE": [ "CWE-1333" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-16T13:10:45.831768Z", "name": "openssl", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-07-20T01:50:10.235107Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3446" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1fa20cf2f506113c761777127a38bce5068740eb" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8780a896543a654e757db1b9396383f9d8095528" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fc9867c1e03c22ebf56943be205202e576aabf23" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230719.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/4" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/6" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230803-0011/" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Inefficient Regular Expression Complexity", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cpes": [], "creationTime": "2023-08-01T13:45:07.815112Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-08-01T13:31:51.629782Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T01:12:10.245558Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2023-08-09T11:03:42.422326Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIssue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the "-check" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `openssl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3817)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f)\n- [openssl-security@openssl.org](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5)\n- [openssl-security@openssl.org](https://www.openssl.org/news/secadv/20230731.txt)\n- [openssl-security@openssl.org](http://www.openwall.com/lists/oss-security/2023/07/31/1)\n- [openssl-security@openssl.org](http://seclists.org/fulldisclosure/2023/Jul/43)\n- [openssl-security@openssl.org](https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html)\n- [openssl-security@openssl.org](https://security.netapp.com/advisory/ntap-20230818-0014/)\n", "disclosureTime": "2023-07-31T16:15:10.497000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43243", "probability": "0.00109" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "ca-certificates@20230311", "openssl@3.0.9-1" ], "id": "SNYK-DEBIAN12-OPENSSL-5812633", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3817" ], "CWE": [ "CWE-834" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-19T01:10:44.145109Z", "name": "openssl", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "openssl", "patches": [], "publicationTime": "2023-08-01T13:44:38.433704Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3817" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a1eb62c29db6cb5eec707f9338aee00f44e26f5" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9002fd07327a91f35ba6c1307e71fa6fd4409b7f" }, { "title": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=91ddeba0f2269b017dc06c46c993a788974b1aa5" }, { "title": "openssl-security@openssl.org", "url": "https://www.openssl.org/news/secadv/20230731.txt" }, { "title": "openssl-security@openssl.org", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "title": "openssl-security@openssl.org", "url": "http://seclists.org/fulldisclosure/2023/Jul/43" }, { "title": "openssl-security@openssl.org", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" }, { "title": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20230818-0014/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Excessive Iteration", "upgradePath": [], "version": "3.0.9-1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cpes": [], "creationTime": "2021-08-15T06:58:59.954662Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "modificationTime": "2022-01-03T17:22:53.611516Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "modificationTime": "2023-02-09T11:25:02.391574Z", "severity": "low" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n_is_safe in the File::Temp module for Perl does not properly handle symlinks.\n## Remediation\nThere is no fixed version for `Debian:12` `perl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2011-4116)\n- [GitHub Issue](https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14)\n- [MISC](https://rt.cpan.org/Public/Bug/Display.html?id=69106)\n- [Oss-Sec Mailing List](https://seclists.org/oss-sec/2011/q4/238)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2011/11/04/2)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2011/11/04/4)\n", "disclosureTime": "2020-01-31T18:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.60978", "probability": "0.00243" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "perl/perl-base@5.36.0-7" ], "id": "SNYK-DEBIAN12-PERL-1556505", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2011-4116" ], "CWE": [ "CWE-59" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-09T11:25:02.391574Z", "name": "perl/perl-base", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "perl", "patches": [], "publicationTime": "2018-06-27T16:23:21.190689Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2011-4116" }, { "title": "GitHub Issue", "url": "https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14" }, { "title": "MISC", "url": "https://rt.cpan.org/Public/Bug/Display.html?id=69106" }, { "title": "Oss-Sec Mailing List", "url": "https://seclists.org/oss-sec/2011/q4/238" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2011/11/04/2" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2011/11/04/4" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Link Following", "upgradePath": [], "version": "5.36.0-7" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2023-04-29T13:25:24.484403Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 8.1, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-05-09T01:10:09.099028Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 7.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "modificationTime": "2023-08-02T13:42:57.250231Z", "severity": "high" } ], "cvssScore": 8.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nHTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.\n## Remediation\nThere is no fixed version for `Debian:12` `perl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31486)\n- [cve@mitre.org](https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/)\n- [cve@mitre.org](https://hackeriet.github.io/cpan-http-tiny-overview/)\n- [cve@mitre.org](https://www.openwall.com/lists/oss-security/2023/04/18/14)\n- [cve@mitre.org](https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/04/29/1)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/03/3)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/03/5)\n- [cve@mitre.org](https://www.openwall.com/lists/oss-security/2023/05/03/4)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/07/2)\n- [cve@mitre.org](https://github.com/chansen/p5-http-tiny/pull/153)\n", "disclosureTime": "2023-04-29T00:15:09.083000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.58045", "probability": "0.00210" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "perl/perl-base@5.36.0-7" ], "id": "SNYK-DEBIAN12-PERL-5489184", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31486" ], "CWE": [ "CWE-295" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-02T13:42:57.250231Z", "name": "perl/perl-base", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "perl", "patches": [], "publicationTime": "2023-04-29T12:53:47.378128Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31486" }, { "title": "cve@mitre.org", "url": "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/" }, { "title": "cve@mitre.org", "url": "https://hackeriet.github.io/cpan-http-tiny-overview/" }, { "title": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2023/04/18/14" }, { "title": "cve@mitre.org", "url": "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/" }, { "title": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/04/29/1" }, { "title": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/05/03/3" }, { "title": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/05/03/5" }, { "title": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2023/05/03/4" }, { "title": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/05/07/2" }, { "title": "cve@mitre.org", "url": "https://github.com/chansen/p5-http-tiny/pull/153" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Certificate Validation", "upgradePath": [], "version": "5.36.0-7" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2023-04-29T13:28:31.639164Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 8.1, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-05-09T01:10:08.314422Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 7.4, "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "modificationTime": "2023-07-04T13:41:21.887677Z", "severity": "high" } ], "cvssScore": 8.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nCPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.\n## Remediation\nThere is no fixed version for `Debian:12` `perl`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31484)\n- [cve@mitre.org](https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/)\n- [cve@mitre.org](https://github.com/andk/cpanpm/pull/175)\n- [cve@mitre.org](https://metacpan.org/dist/CPAN/changes)\n- [cve@mitre.org](https://www.openwall.com/lists/oss-security/2023/04/18/14)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/04/29/1)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/03/3)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/03/5)\n- [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/05/07/2)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/)\n", "disclosureTime": "2023-04-29T00:15:09Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.59805", "probability": "0.00224" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "perl/perl-base@5.36.0-7" ], "id": "SNYK-DEBIAN12-PERL-5489190", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31484" ], "CWE": [ "CWE-295" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-03T01:10:46.794085Z", "name": "perl/perl-base", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "perl", "patches": [], "publicationTime": "2023-04-29T13:26:29.033813Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31484" }, { "title": "cve@mitre.org", "url": "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/" }, { "title": "cve@mitre.org", "url": "https://github.com/andk/cpanpm/pull/175" }, { "title": "cve@mitre.org", "url": "https://metacpan.org/dist/CPAN/changes" }, { "title": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2023/04/18/14" }, { "title": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/04/29/1" }, { "title": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/05/03/3" }, { "title": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/05/03/5" }, { "title": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2023/05/07/2" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Certificate Validation", "upgradePath": [], "version": "5.36.0-7" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T07:00:48.804032Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.2, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:34.700307Z", "severity": "medium" } ], "cvssScore": 6.2, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ninitscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-5686)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482129/100/100/threaded)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482857/100/0/threaded)\n- [CONFIRM](https://issues.rpath.com/browse/RPL-1825)\n- [Secunia Advisory](http://secunia.com/advisories/27215)\n- [Security Focus](http://www.securityfocus.com/bid/26048)\n- [VUPEN](http://www.vupen.com/english/advisories/2007/3474)\n", "disclosureTime": "2007-10-28T17:08:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.44187", "probability": "0.00115" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-1559391", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-5686" ], "CWE": [ "CWE-264" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:28.790130Z", "name": "shadow/passwd", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2007-10-28T17:08:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-5686" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded" }, { "title": "CONFIRM", "url": "https://issues.rpath.com/browse/RPL-1825" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/27215" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/26048" }, { "title": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/3474" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access Restriction Bypass", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T07:00:49.238181Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.8, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T17:57:47.307851Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 7.8, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2022-09-01T21:39:40.719759Z", "severity": "high" } ], "cvssScore": 7.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nshadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-19882)\n- [GENTOO](https://security.gentoo.org/glsa/202008-09)\n- [GitHub Commit](https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75)\n- [GitHub PR](https://github.com/shadow-maint/shadow/pull/199)\n- [GitHub PR](https://github.com/void-linux/void-packages/pull/17580)\n- [MISC](https://bugs.archlinux.org/task/64836)\n- [MISC](https://bugs.gentoo.org/702252)\n", "disclosureTime": "2019-12-18T16:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-1559403", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-19882" ], "CWE": [ "CWE-732" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-23T15:46:01.468382Z", "name": "shadow/passwd", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2019-12-26T23:36:05.550389Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-19882" }, { "title": "GENTOO", "url": "https://security.gentoo.org/glsa/202008-09" }, { "title": "GitHub Commit", "url": "https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75" }, { "title": "GitHub PR", "url": "https://github.com/shadow-maint/shadow/pull/199" }, { "title": "GitHub PR", "url": "https://github.com/void-linux/void-packages/pull/17580" }, { "title": "MISC", "url": "https://bugs.archlinux.org/task/64836" }, { "title": "MISC", "url": "https://bugs.gentoo.org/702252" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Incorrect Permission Assignment for Critical Resource", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-02-05T01:28:06.246878Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 7.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "modificationTime": "2023-02-02T14:09:18.143374Z", "severity": "high" } ], "cvssScore": null, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-0634)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-0634)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2166544)\n- [secalert@redhat.com](https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/)\n- [secalert@redhat.com](https://github.com/shadow-maint/shadow/pull/642)\n", "disclosureTime": "2023-02-02T23:15:09.543000Z", "epssDetails": null, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-3310897", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-0634" ], "CWE": [ "CWE-476" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T15:03:21.451757Z", "name": "shadow/passwd", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2023-02-05T01:28:01.211727Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-0634" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2023-0634" }, { "title": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166544" }, { "title": "secalert@redhat.com", "url": "https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/" }, { "title": "secalert@redhat.com", "url": "https://github.com/shadow-maint/shadow/pull/642" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "NULL Pointer Dereference", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-04-15T13:42:56.921177Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-04-17T13:44:24.514320Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-04-25T01:10:07.942693Z", "severity": "low" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-04-29T11:02:08.614218Z", "severity": "medium" } ], "cvssScore": 3.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-29383)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/pull/687)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797)\n", "disclosureTime": "2023-04-14T22:15:07.680000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.12321", "probability": "0.00045" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-5423923", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-29383" ], "CWE": [ "CWE-74" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-29T01:27:37.802213Z", "name": "shadow/passwd", "nvdSeverity": "low", "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2023-04-15T13:42:55.908897Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-29383" }, { "title": "cve@mitre.org", "url": "https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d" }, { "title": "cve@mitre.org", "url": "https://github.com/shadow-maint/shadow/pull/687" }, { "title": "cve@mitre.org", "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/" }, { "title": "cve@mitre.org", "url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Arbitrary Code Injection", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-09-01T14:50:18.745873Z", "credit": [ "" ], "cvssDetails": [], "cvssScore": null, "description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4641)\n", "disclosureTime": null, "epssDetails": null, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-5879156", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-4641" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-01T14:50:18.745899Z", "name": "shadow/passwd", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2023-09-01T14:42:22.874860Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-4641" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-4641", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T07:00:48.804032Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.2, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:34.700307Z", "severity": "medium" } ], "cvssScore": 6.2, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ninitscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-5686)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482129/100/100/threaded)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482857/100/0/threaded)\n- [CONFIRM](https://issues.rpath.com/browse/RPL-1825)\n- [Secunia Advisory](http://secunia.com/advisories/27215)\n- [Security Focus](http://www.securityfocus.com/bid/26048)\n- [VUPEN](http://www.vupen.com/english/advisories/2007/3474)\n", "disclosureTime": "2007-10-28T17:08:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.44187", "probability": "0.00115" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "adduser@3.134", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-1559391", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-5686" ], "CWE": [ "CWE-264" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:28.790130Z", "name": "shadow/passwd", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2007-10-28T17:08:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-5686" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded" }, { "title": "CONFIRM", "url": "https://issues.rpath.com/browse/RPL-1825" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/27215" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/26048" }, { "title": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/3474" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access Restriction Bypass", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T07:00:49.238181Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.8, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T17:57:47.307851Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 7.8, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2022-09-01T21:39:40.719759Z", "severity": "high" } ], "cvssScore": 7.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nshadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-19882)\n- [GENTOO](https://security.gentoo.org/glsa/202008-09)\n- [GitHub Commit](https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75)\n- [GitHub PR](https://github.com/shadow-maint/shadow/pull/199)\n- [GitHub PR](https://github.com/void-linux/void-packages/pull/17580)\n- [MISC](https://bugs.archlinux.org/task/64836)\n- [MISC](https://bugs.gentoo.org/702252)\n", "disclosureTime": "2019-12-18T16:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "adduser@3.134", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-1559403", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-19882" ], "CWE": [ "CWE-732" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-23T15:46:01.468382Z", "name": "shadow/passwd", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2019-12-26T23:36:05.550389Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-19882" }, { "title": "GENTOO", "url": "https://security.gentoo.org/glsa/202008-09" }, { "title": "GitHub Commit", "url": "https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75" }, { "title": "GitHub PR", "url": "https://github.com/shadow-maint/shadow/pull/199" }, { "title": "GitHub PR", "url": "https://github.com/void-linux/void-packages/pull/17580" }, { "title": "MISC", "url": "https://bugs.archlinux.org/task/64836" }, { "title": "MISC", "url": "https://bugs.gentoo.org/702252" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Incorrect Permission Assignment for Critical Resource", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-02-05T01:28:06.246878Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 7.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "modificationTime": "2023-02-02T14:09:18.143374Z", "severity": "high" } ], "cvssScore": null, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-0634)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-0634)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2166544)\n- [secalert@redhat.com](https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/)\n- [secalert@redhat.com](https://github.com/shadow-maint/shadow/pull/642)\n", "disclosureTime": "2023-02-02T23:15:09.543000Z", "epssDetails": null, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "adduser@3.134", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-3310897", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-0634" ], "CWE": [ "CWE-476" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T15:03:21.451757Z", "name": "shadow/passwd", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2023-02-05T01:28:01.211727Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-0634" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2023-0634" }, { "title": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166544" }, { "title": "secalert@redhat.com", "url": "https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/" }, { "title": "secalert@redhat.com", "url": "https://github.com/shadow-maint/shadow/pull/642" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "NULL Pointer Dereference", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-04-15T13:42:56.921177Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-04-17T13:44:24.514320Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-04-25T01:10:07.942693Z", "severity": "low" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-04-29T11:02:08.614218Z", "severity": "medium" } ], "cvssScore": 3.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-29383)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/pull/687)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797)\n", "disclosureTime": "2023-04-14T22:15:07.680000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.12321", "probability": "0.00045" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "adduser@3.134", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-5423923", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-29383" ], "CWE": [ "CWE-74" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-29T01:27:37.802213Z", "name": "shadow/passwd", "nvdSeverity": "low", "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2023-04-15T13:42:55.908897Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-29383" }, { "title": "cve@mitre.org", "url": "https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d" }, { "title": "cve@mitre.org", "url": "https://github.com/shadow-maint/shadow/pull/687" }, { "title": "cve@mitre.org", "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/" }, { "title": "cve@mitre.org", "url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Arbitrary Code Injection", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-09-01T14:50:18.745873Z", "credit": [ "" ], "cvssDetails": [], "cvssScore": null, "description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4641)\n", "disclosureTime": null, "epssDetails": null, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "adduser@3.134", "shadow/passwd@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-5879156", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-4641" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-01T14:50:18.745899Z", "name": "shadow/passwd", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2023-09-01T14:42:22.874860Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-4641" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-4641", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2021-08-15T07:00:48.804032Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.2, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2023-02-09T11:22:34.700307Z", "severity": "medium" } ], "cvssScore": 6.2, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\ninitscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2007-5686)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482129/100/100/threaded)\n- [BUGTRAQ](http://www.securityfocus.com/archive/1/482857/100/0/threaded)\n- [CONFIRM](https://issues.rpath.com/browse/RPL-1825)\n- [Secunia Advisory](http://secunia.com/advisories/27215)\n- [Security Focus](http://www.securityfocus.com/bid/26048)\n- [VUPEN](http://www.vupen.com/english/advisories/2007/3474)\n", "disclosureTime": "2007-10-28T17:08:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.44187", "probability": "0.00115" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/login@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-1559391", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2007-5686" ], "CWE": [ "CWE-264" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:28.790130Z", "name": "shadow/login", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2007-10-28T17:08:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2007-5686" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/482129/100/100/threaded" }, { "title": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/482857/100/0/threaded" }, { "title": "CONFIRM", "url": "https://issues.rpath.com/browse/RPL-1825" }, { "title": "Secunia Advisory", "url": "http://secunia.com/advisories/27215" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/26048" }, { "title": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/3474" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Access Restriction Bypass", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T07:00:49.238181Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.8, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T17:57:47.307851Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 7.8, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2022-09-01T21:39:40.719759Z", "severity": "high" } ], "cvssScore": 7.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nshadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2019-19882)\n- [GENTOO](https://security.gentoo.org/glsa/202008-09)\n- [GitHub Commit](https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75)\n- [GitHub PR](https://github.com/shadow-maint/shadow/pull/199)\n- [GitHub PR](https://github.com/void-linux/void-packages/pull/17580)\n- [MISC](https://bugs.archlinux.org/task/64836)\n- [MISC](https://bugs.gentoo.org/702252)\n", "disclosureTime": "2019-12-18T16:15:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/login@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-1559403", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2019-19882" ], "CWE": [ "CWE-732" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-23T15:46:01.468382Z", "name": "shadow/login", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2019-12-26T23:36:05.550389Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2019-19882" }, { "title": "GENTOO", "url": "https://security.gentoo.org/glsa/202008-09" }, { "title": "GitHub Commit", "url": "https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75" }, { "title": "GitHub PR", "url": "https://github.com/shadow-maint/shadow/pull/199" }, { "title": "GitHub PR", "url": "https://github.com/void-linux/void-packages/pull/17580" }, { "title": "MISC", "url": "https://bugs.archlinux.org/task/64836" }, { "title": "MISC", "url": "https://bugs.gentoo.org/702252" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Incorrect Permission Assignment for Critical Resource", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-02-05T01:28:06.246878Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 7.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "modificationTime": "2023-02-02T14:09:18.143374Z", "severity": "high" } ], "cvssScore": null, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-0634)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-0634)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2166544)\n- [secalert@redhat.com](https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/)\n- [secalert@redhat.com](https://github.com/shadow-maint/shadow/pull/642)\n", "disclosureTime": "2023-02-02T23:15:09.543000Z", "epssDetails": null, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/login@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-3310897", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-0634" ], "CWE": [ "CWE-476" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T15:03:21.451757Z", "name": "shadow/login", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2023-02-05T01:28:01.211727Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-0634" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2023-0634" }, { "title": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166544" }, { "title": "secalert@redhat.com", "url": "https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/" }, { "title": "secalert@redhat.com", "url": "https://github.com/shadow-maint/shadow/pull/642" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "NULL Pointer Dereference", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-04-15T13:42:56.921177Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-04-17T13:44:24.514320Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-04-25T01:10:07.942693Z", "severity": "low" }, { "assigner": "SUSE", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2023-04-29T11:02:08.614218Z", "severity": "medium" } ], "cvssScore": 3.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-29383)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d)\n- [cve@mitre.org](https://github.com/shadow-maint/shadow/pull/687)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/)\n- [cve@mitre.org](https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797)\n", "disclosureTime": "2023-04-14T22:15:07.680000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.12321", "probability": "0.00045" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/login@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-5423923", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-29383" ], "CWE": [ "CWE-74" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-29T01:27:37.802213Z", "name": "shadow/login", "nvdSeverity": "low", "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2023-04-15T13:42:55.908897Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-29383" }, { "title": "cve@mitre.org", "url": "https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d" }, { "title": "cve@mitre.org", "url": "https://github.com/shadow-maint/shadow/pull/687" }, { "title": "cve@mitre.org", "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/" }, { "title": "cve@mitre.org", "url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Arbitrary Code Injection", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-09-01T14:50:18.745873Z", "credit": [ "" ], "cvssDetails": [], "cvssScore": null, "description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `shadow`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-4641)\n", "disclosureTime": null, "epssDetails": null, "exploit": "Not Defined", "fixedIn": [], "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "shadow/login@1:4.13+dfsg1-1+b1" ], "id": "SNYK-DEBIAN12-SHADOW-5879156", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-4641" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-09-01T14:50:18.745899Z", "name": "shadow/login", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "shadow", "patches": [], "publicationTime": "2023-09-01T14:42:22.874860Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-4641" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-4641", "upgradePath": [], "version": "1:4.13+dfsg1-1+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T07:01:37.095633Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:04.917718Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:01.372472Z", "severity": "medium" } ], "cvssScore": 4.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n", "disclosureTime": "2013-10-28T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-1560739", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-4392" ], "CWE": [ "CWE-59" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:25.692385Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2013-10-28T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-4392" }, { "title": "Debian Bug Report", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/10/01/9" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Link Following", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:09:56.188438Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.768445Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.657000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733385", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31437" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.797299Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:09:56.168947Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31437" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:10:41.420741Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:14.042342Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.707000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733390", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31438" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:14.072640Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:41.403795Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31438" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:12:26.081346Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.607988Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.753000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733398", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31439" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.638662Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:02.817493Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31439" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T07:01:37.095633Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:04.917718Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:01.372472Z", "severity": "medium" } ], "cvssScore": 4.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n", "disclosureTime": "2013-10-28T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-1560739", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-4392" ], "CWE": [ "CWE-59" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:25.692385Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2013-10-28T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-4392" }, { "title": "Debian Bug Report", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/10/01/9" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Link Following", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:09:56.188438Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.768445Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.657000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733385", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31437" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.797299Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:09:56.168947Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31437" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:10:41.420741Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:14.042342Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.707000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733390", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31438" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:14.072640Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:41.403795Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31438" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:12:26.081346Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.607988Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.753000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733398", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31439" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.638662Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:02.817493Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31439" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T07:01:37.095633Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:04.917718Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:01.372472Z", "severity": "medium" } ], "cvssScore": 4.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n", "disclosureTime": "2013-10-28T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/bsdutils@1:2.38.1-5+b1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-1560739", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-4392" ], "CWE": [ "CWE-59" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:25.692385Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2013-10-28T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-4392" }, { "title": "Debian Bug Report", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/10/01/9" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Link Following", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:09:56.188438Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.768445Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.657000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/bsdutils@1:2.38.1-5+b1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733385", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31437" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.797299Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:09:56.168947Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31437" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:10:41.420741Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:14.042342Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.707000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/bsdutils@1:2.38.1-5+b1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733390", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31438" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:14.072640Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:41.403795Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31438" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:12:26.081346Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.607988Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.753000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/bsdutils@1:2.38.1-5+b1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733398", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31439" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.638662Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:02.817493Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31439" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T07:01:37.095633Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:04.917718Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:01.372472Z", "severity": "medium" } ], "cvssScore": 4.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n", "disclosureTime": "2013-10-28T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-1560739", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-4392" ], "CWE": [ "CWE-59" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:25.692385Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2013-10-28T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-4392" }, { "title": "Debian Bug Report", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/10/01/9" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Link Following", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:09:56.188438Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.768445Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.657000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733385", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31437" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.797299Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:09:56.168947Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31437" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:10:41.420741Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:14.042342Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.707000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733390", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31438" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:14.072640Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:41.403795Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31438" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:12:26.081346Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.607988Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.753000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733398", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31439" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.638662Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:02.817493Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31439" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T07:01:37.095633Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:04.917718Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:01.372472Z", "severity": "medium" } ], "cvssScore": 4.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n", "disclosureTime": "2013-10-28T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-1560739", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-4392" ], "CWE": [ "CWE-59" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:25.692385Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2013-10-28T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-4392" }, { "title": "Debian Bug Report", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/10/01/9" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Link Following", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:09:56.188438Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.768445Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.657000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733385", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31437" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.797299Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:09:56.168947Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31437" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:10:41.420741Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:14.042342Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.707000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733390", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31438" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:14.072640Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:41.403795Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31438" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:12:26.081346Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.607988Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.753000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "systemd/libsystemd0@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733398", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31439" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.638662Z", "name": "systemd/libsystemd0", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:02.817493Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31439" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T07:01:37.095633Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:04.917718Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:01.372472Z", "severity": "medium" } ], "cvssScore": 4.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n", "disclosureTime": "2013-10-28T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-1560739", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-4392" ], "CWE": [ "CWE-59" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:25.692385Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2013-10-28T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-4392" }, { "title": "Debian Bug Report", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/10/01/9" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Link Following", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:09:56.188438Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.768445Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.657000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733385", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31437" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.797299Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:09:56.168947Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31437" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:10:41.420741Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:14.042342Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.707000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733390", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31438" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:14.072640Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:41.403795Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31438" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:12:26.081346Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.607988Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.753000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733398", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31439" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.638662Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:02.817493Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31439" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T07:01:37.095633Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:04.917718Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:01.372472Z", "severity": "medium" } ], "cvssScore": 4.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n", "disclosureTime": "2013-10-28T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-1560739", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-4392" ], "CWE": [ "CWE-59" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:25.692385Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2013-10-28T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-4392" }, { "title": "Debian Bug Report", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/10/01/9" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Link Following", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:09:56.188438Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.768445Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.657000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733385", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31437" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.797299Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:09:56.168947Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31437" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:10:41.420741Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:14.042342Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.707000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733390", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31438" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:14.072640Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:41.403795Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31438" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:12:26.081346Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.607988Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.753000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733398", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31439" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.638662Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:02.817493Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31439" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cpes": [], "creationTime": "2021-08-15T07:01:37.095633Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:24:04.917718Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.4, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modificationTime": "2023-02-09T11:25:01.372472Z", "severity": "medium" } ], "cvssScore": 4.4, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2013-4392)\n- [Debian Bug Report](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2013/10/01/9)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=859060)\n", "disclosureTime": "2013-10-28T22:55:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.05680", "probability": "0.00042" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-1560739", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2013-4392" ], "CWE": [ "CWE-59" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:25.692385Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2013-10-28T22:55:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2013-4392" }, { "title": "Debian Bug Report", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2013/10/01/9" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=859060" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Link Following", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:09:56.188438Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.768445Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31437)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.657000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733385", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31437" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.797299Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:09:56.168947Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31437" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:10:41.420741Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:14.042342Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31438)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.707000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733390", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31438" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:14.072640Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:41.403795Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31438" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cpes": [], "creationTime": "2023-06-22T14:12:26.081346Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-06-24T01:12:13.607988Z", "severity": "medium" } ], "cvssScore": 5.3, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."\n## Remediation\nThere is no fixed version for `Debian:12` `systemd`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-31439)\n- [cve@mitre.org](https://github.com/kastel-security/Journald)\n- [cve@mitre.org](https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf)\n- [cve@mitre.org](https://github.com/systemd/systemd/releases)\n", "disclosureTime": "2023-06-13T17:15:14.753000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.25351", "probability": "0.00063" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "apt@2.6.1", "apt/libapt-pkg6.0@2.6.1", "systemd/libudev1@252.12-1~deb12u1" ], "id": "SNYK-DEBIAN12-SYSTEMD-5733398", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-31439" ], "CWE": [ "CWE-354" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-24T01:12:13.638662Z", "name": "systemd/libudev1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "systemd", "patches": [], "publicationTime": "2023-06-22T14:10:02.817493Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-31439" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald" }, { "title": "cve@mitre.org", "url": "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf" }, { "title": "cve@mitre.org", "url": "https://github.com/systemd/systemd/releases" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Improper Validation of Integrity Check Value", "upgradePath": [], "version": "252.12-1~deb12u1" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T07:01:33.066223Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 7, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "modificationTime": "2022-09-01T13:32:26.235513Z", "severity": "high" }, { "assigner": "NVD", "cvssV3BaseScore": 9.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-02-09T11:22:04.134667Z", "severity": "critical" } ], "cvssScore": 9.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nTar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.\n## Remediation\nThere is no fixed version for `Debian:12` `tar`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2005-2541)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=112327628230258&w=2)\n- [MLIST](https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E)\n", "disclosureTime": "2005-08-10T04:00:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75827", "probability": "0.00617" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "tar@1.34+dfsg-1.2" ], "id": "SNYK-DEBIAN12-TAR-1560620", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2005-2541" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:19.575213Z", "name": "tar", "nvdSeverity": "critical", "packageManager": "debian:12", "packageName": "tar", "patches": [], "publicationTime": "2005-08-10T04:00:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2005-2541" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=112327628230258&w=2" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2005-2541", "upgradePath": [], "version": "1.34+dfsg-1.2" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-01-31T01:33:03.317282Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-05-31T01:10:21.333707Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-02-21T11:02:09.756196Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-05-29T14:19:01.130316Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.\n## Remediation\nThere is no fixed version for `Debian:12` `tar`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-48303)\n- [cve@mitre.org](https://savannah.gnu.org/bugs/?62387)\n- [cve@mitre.org](https://savannah.gnu.org/patch/?10307)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/)\n", "disclosureTime": "2023-01-30T04:15:08.030000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.08395", "probability": "0.00044" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "tar@1.34+dfsg-1.2" ], "id": "SNYK-DEBIAN12-TAR-3253526", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-48303" ], "CWE": [ "CWE-125" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-31T01:10:21.357718Z", "name": "tar", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tar", "patches": [], "publicationTime": "2023-01-31T01:33:03.297646Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-48303" }, { "title": "cve@mitre.org", "url": "https://savannah.gnu.org/bugs/?62387" }, { "title": "cve@mitre.org", "url": "https://savannah.gnu.org/patch/?10307" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-bounds Read", "upgradePath": [], "version": "1.34+dfsg-1.2" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T07:01:33.066223Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 7, "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "modificationTime": "2022-09-01T13:32:26.235513Z", "severity": "high" }, { "assigner": "NVD", "cvssV3BaseScore": 9.8, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2023-02-09T11:22:04.134667Z", "severity": "critical" } ], "cvssScore": 9.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nTar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.\n## Remediation\nThere is no fixed version for `Debian:12` `tar`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2005-2541)\n- [HP Security Bulletin](http://marc.info/?l=bugtraq&m=112327628230258&w=2)\n- [MLIST](https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E)\n", "disclosureTime": "2005-08-10T04:00:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75827", "probability": "0.00617" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "dash@0.5.12-2", "dpkg@1.21.22", "tar@1.34+dfsg-1.2" ], "id": "SNYK-DEBIAN12-TAR-1560620", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2005-2541" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:19.575213Z", "name": "tar", "nvdSeverity": "critical", "packageManager": "debian:12", "packageName": "tar", "patches": [], "publicationTime": "2005-08-10T04:00:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2005-2541" }, { "title": "HP Security Bulletin", "url": "http://marc.info/?l=bugtraq&m=112327628230258&w=2" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2005-2541", "upgradePath": [], "version": "1.34+dfsg-1.2" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-01-31T01:33:03.317282Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-05-31T01:10:21.333707Z", "severity": "medium" }, { "assigner": "SUSE", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "modificationTime": "2023-02-21T11:02:09.756196Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-05-29T14:19:01.130316Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.\n## Remediation\nThere is no fixed version for `Debian:12` `tar`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-48303)\n- [cve@mitre.org](https://savannah.gnu.org/bugs/?62387)\n- [cve@mitre.org](https://savannah.gnu.org/patch/?10307)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/)\n- [cve@mitre.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/)\n", "disclosureTime": "2023-01-30T04:15:08.030000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.08395", "probability": "0.00044" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "dash@0.5.12-2", "dpkg@1.21.22", "tar@1.34+dfsg-1.2" ], "id": "SNYK-DEBIAN12-TAR-3253526", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-48303" ], "CWE": [ "CWE-125" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-05-31T01:10:21.357718Z", "name": "tar", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tar", "patches": [], "publicationTime": "2023-01-31T01:33:03.297646Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-48303" }, { "title": "cve@mitre.org", "url": "https://savannah.gnu.org/bugs/?62387" }, { "title": "cve@mitre.org", "url": "https://savannah.gnu.org/patch/?10307" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/" }, { "title": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-bounds Read", "upgradePath": [], "version": "1.34+dfsg-1.2" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2021-08-15T07:01:43.543628Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-01-03T16:21:24.703910Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "modificationTime": "2022-09-01T14:49:11.956111Z", "severity": "low" } ], "cvssScore": 7.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-16232)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16232)\n- [MISC](http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html)\n- [OpenSuse Security Announcement](http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2017/11/01/11)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2017/11/01/3)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2017/11/01/7)\n- [OSS security Advisory](http://www.openwall.com/lists/oss-security/2017/11/01/8)\n- [Seclists Full Disclosure](http://seclists.org/fulldisclosure/2018/Dec/32)\n- [Seclists Full Disclosure](http://seclists.org/fulldisclosure/2018/Dec/47)\n- [Security Focus](http://www.securityfocus.com/bid/101696)\n", "disclosureTime": "2019-03-21T15:59:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.85712", "probability": "0.01625" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-1560922", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2017-16232" ], "CWE": [ "CWE-772" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2022-10-31T01:44:16.684608Z", "name": "tiff/libtiff6", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2018-06-27T16:19:41.704013Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2017-16232" }, { "title": "CVE Details", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16232" }, { "title": "MISC", "url": "http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html" }, { "title": "OpenSuse Security Announcement", "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2017/11/01/11" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2017/11/01/3" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2017/11/01/7" }, { "title": "OSS security Advisory", "url": "http://www.openwall.com/lists/oss-security/2017/11/01/8" }, { "title": "Seclists Full Disclosure", "url": "http://seclists.org/fulldisclosure/2018/Dec/32" }, { "title": "Seclists Full Disclosure", "url": "http://seclists.org/fulldisclosure/2018/Dec/47" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/101696" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Missing Release of Resource after Effective Lifetime", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T07:01:49.472704Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T16:28:04.040572Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.3, "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "modificationTime": "2022-09-01T14:58:13.720843Z", "severity": "medium" } ], "cvssScore": 8.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-5563)\n- [Gentoo Security Advisory](https://security.gentoo.org/glsa/201709-27)\n- [MISC](http://bugzilla.maptools.org/show_bug.cgi?id=2664)\n- [Security Focus](http://www.securityfocus.com/bid/95705)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-5563)\n- [Ubuntu Security Advisory](https://usn.ubuntu.com/3606-1/)\n", "disclosureTime": "2017-01-23T07:59:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.73997", "probability": "0.00538" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-1561093", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2017-5563" ], "CWE": [ "CWE-125" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:21.099316Z", "name": "tiff/libtiff6", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2017-01-23T07:59:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2017-5563" }, { "title": "Gentoo Security Advisory", "url": "https://security.gentoo.org/glsa/201709-27" }, { "title": "MISC", "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2664" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/95705" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-5563" }, { "title": "Ubuntu Security Advisory", "url": "https://usn.ubuntu.com/3606-1/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-bounds Read", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T07:01:50.766913Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 8.8, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T16:23:36.706695Z", "severity": "high" }, { "assigner": "Red Hat", "cvssV3BaseScore": 7.5, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "modificationTime": "2022-09-01T20:53:50.836827Z", "severity": "high" } ], "cvssScore": 8.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\n** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-17973)\n- [http://bugzilla.maptools.org/show_bug.cgi?id=2769](http://bugzilla.maptools.org/show_bug.cgi?id=2769)\n- [https://bugzilla.novell.com/show_bug.cgi?id=1074318](https://bugzilla.novell.com/show_bug.cgi?id=1074318)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1530912)\n- [Security Focus](http://www.securityfocus.com/bid/102331)\n", "disclosureTime": "2017-12-29T21:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.72507", "probability": "0.00482" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-1561130", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2017-17973" ], "CWE": [ "CWE-416" ] }, "insights": { "triageAdvice": null }, "isDisputed": true, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:16.389568Z", "name": "tiff/libtiff6", "nvdSeverity": "high", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2017-12-29T21:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2017-17973" }, { "title": "http://bugzilla.maptools.org/show_bug.cgi?id=2769", "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2769" }, { "title": "https://bugzilla.novell.com/show_bug.cgi?id=1074318", "url": "https://bugzilla.novell.com/show_bug.cgi?id=1074318" }, { "title": "RedHat Bugzilla Bug", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1530912" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/102331" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Use After Free", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2021-08-15T07:01:59.876806Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-01-03T16:13:00.237638Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "modificationTime": "2022-09-01T21:06:42.937156Z", "severity": "low" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nLibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2018-10126)\n- [MISC](http://bugzilla.maptools.org/show_bug.cgi?id=2786)\n- [MLIST](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-10126)\n", "disclosureTime": "2018-04-21T21:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.33084", "probability": "0.00080" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-1561402", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2018-10126" ], "CWE": [ "CWE-476" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:20.608941Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2018-04-21T21:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2018-10126" }, { "title": "MISC", "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2786" }, { "title": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-10126" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "NULL Pointer Dereference", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cpes": [], "creationTime": "2021-08-15T07:02:08.062262Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 9.8, "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "modificationTime": "2022-01-03T16:31:39.112943Z", "severity": "critical" }, { "assigner": "Red Hat", "cvssV3BaseScore": 3.3, "cvssV3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "modificationTime": "2022-09-01T15:05:32.171314Z", "severity": "low" } ], "cvssScore": 9.8, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2017-9117)\n- [MISC](http://bugzilla.maptools.org/show_bug.cgi?id=2690)\n- [Security Focus](http://www.securityfocus.com/bid/98581)\n- [Ubuntu CVE Tracker](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-9117)\n- [Ubuntu Security Advisory](https://usn.ubuntu.com/3606-1/)\n", "disclosureTime": "2017-05-21T19:29:00Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.75963", "probability": "0.00623" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-1561632", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2017-9117" ], "CWE": [ "CWE-125" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-10T13:11:21.820010Z", "name": "tiff/libtiff6", "nvdSeverity": "critical", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2017-05-21T19:29:00Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2017-9117" }, { "title": "MISC", "url": "http://bugzilla.maptools.org/show_bug.cgi?id=2690" }, { "title": "Security Focus", "url": "http://www.securityfocus.com/bid/98581" }, { "title": "Ubuntu CVE Tracker", "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-9117" }, { "title": "Ubuntu Security Advisory", "url": "https://usn.ubuntu.com/3606-1/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-bounds Read", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2022-04-04T01:55:37.845615Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2022-11-17T01:11:19.424883Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 4.3, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "modificationTime": "2022-11-27T21:32:51.047987Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-1210)\n- [cna@vuldb.com](https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff)\n- [cna@vuldb.com](https://gitlab.com/libtiff/libtiff/-/issues/402)\n- [cna@vuldb.com](https://vuldb.com/?id.196363)\n- [cna@vuldb.com](https://security.netapp.com/advisory/ntap-20220513-0005/)\n- [cna@vuldb.com](https://security.gentoo.org/glsa/202210-10)\n", "disclosureTime": "2022-04-03T09:15:09.033000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.43312", "probability": "0.00112" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-2440572", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-1210" ], "CWE": [ "CWE-400" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:39:35.477859Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2022-04-04T01:55:09.602543Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-1210" }, { "title": "cna@vuldb.com", "url": "https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff" }, { "title": "cna@vuldb.com", "url": "https://gitlab.com/libtiff/libtiff/-/issues/402" }, { "title": "cna@vuldb.com", "url": "https://vuldb.com/?id.196363" }, { "title": "cna@vuldb.com", "url": "https://security.netapp.com/advisory/ntap-20220513-0005/" }, { "title": "cna@vuldb.com", "url": "https://security.gentoo.org/glsa/202210-10" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Resource Exhaustion", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "cpes": [], "creationTime": "2023-04-07T13:47:31.219670Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 6.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "modificationTime": "2023-04-07T13:45:12.964278Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 6.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "modificationTime": "2023-04-19T01:10:05.651394Z", "severity": "medium" } ], "cvssScore": 6.1, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-1916)\n- [secalert@redhat.com](https://gitlab.com/libtiff/libtiff/-/issues/536,)\n- [secalert@redhat.com](https://gitlab.com/libtiff/libtiff/-/issues/537)\n- [nvd@nist.gov](https://gitlab.com/libtiff/libtiff/-/issues/536)\n", "disclosureTime": "2023-04-10T22:15:09.223000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.12930", "probability": "0.00046" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5416364", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-1916" ], "CWE": [ "CWE-125" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-04-19T01:10:05.674313Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-04-07T13:45:38.039231Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-1916" }, { "title": "secalert@redhat.com", "url": "https://gitlab.com/libtiff/libtiff/-/issues/536%2C" }, { "title": "secalert@redhat.com", "url": "https://gitlab.com/libtiff/libtiff/-/issues/537" }, { "title": "nvd@nist.gov", "url": "https://gitlab.com/libtiff/libtiff/-/issues/536" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-bounds Read", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-06-09T13:49:02.769774Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-06-09T13:45:30.313460Z", "severity": "medium" } ], "cvssScore": null, "description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3164)\n", "disclosureTime": null, "epssDetails": null, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5673710", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3164" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-06-09T13:49:02.769794Z", "name": "tiff/libtiff6", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-06-09T13:48:15.159265Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3164" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-3164", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-06-20T14:36:41.860913Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-06-27T13:12:19.362020Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-06-20T13:42:41.144521Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.\n\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3316)\n- [reefs@jfrog.com](https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/)\n- [reefs@jfrog.com](https://gitlab.com/libtiff/libtiff/-/issues/515)\n- [reefs@jfrog.com](https://gitlab.com/libtiff/libtiff/-/merge_requests/468)\n- [reefs@jfrog.com](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n", "disclosureTime": "2023-06-19T12:15:09.520000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.17922", "probability": "0.00052" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5724640", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3316" ], "CWE": [ "CWE-476" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:10:42.700528Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-06-20T14:34:55.183235Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3316" }, { "title": "reefs@jfrog.com", "url": "https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/" }, { "title": "reefs@jfrog.com", "url": "https://gitlab.com/libtiff/libtiff/-/issues/515" }, { "title": "reefs@jfrog.com", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/468" }, { "title": "reefs@jfrog.com", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "NULL Pointer Dereference", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-06-29T14:55:58.624419Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-06-28T13:42:44.998966Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-06-29T01:12:35.645915Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nloadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-26965)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/merge_requests/472)\n- [cve@mitre.org](https://security.netapp.com/advisory/ntap-20230706-0009/)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n", "disclosureTime": "2023-06-14T21:15:09.483000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.08313", "probability": "0.00044" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5747599", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-26965" ], "CWE": [ "CWE-787" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:10:42.813660Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-06-29T14:55:55.922969Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-26965" }, { "title": "cve@mitre.org", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/472" }, { "title": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20230706-0009/" }, { "title": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Out-of-bounds Write", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-07-01T02:14:00.280441Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-07-12T01:12:38.385697Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-07-13T15:08:27.338886Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-26966)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/issues/530)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/merge_requests/473)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n", "disclosureTime": "2023-06-29T20:15:09.873000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.08313", "probability": "0.00044" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5749338", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-26966" ], "CWE": [ "CWE-120" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:10:43.178733Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-07-01T02:14:00.135262Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-26966" }, { "title": "cve@mitre.org", "url": "https://gitlab.com/libtiff/libtiff/-/issues/530" }, { "title": "cve@mitre.org", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/473" }, { "title": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Buffer Overflow", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-07-01T15:32:07.917180Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-06-30T13:59:11.123808Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-07-11T01:12:12.131969Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-2908)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-2908)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2218830)\n- [secalert@redhat.com](https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f)\n- [secalert@redhat.com](https://gitlab.com/libtiff/libtiff/-/merge_requests/479)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230731-0004/)\n- [secalert@redhat.com](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n", "disclosureTime": "2023-06-30T22:15:10.017000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.14042", "probability": "0.00046" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5750144", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-2908" ], "CWE": [ "CWE-476" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-03T01:10:47.686648Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-07-01T15:32:06.173406Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-2908" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2023-2908" }, { "title": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218830" }, { "title": "secalert@redhat.com", "url": "https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f" }, { "title": "secalert@redhat.com", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/479" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20230731-0004/" }, { "title": "secalert@redhat.com", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "NULL Pointer Dereference", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-07-08T15:37:40.425363Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-07-12T01:12:38.189984Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 7.1, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "modificationTime": "2023-07-13T15:08:57.249306Z", "severity": "high" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nlibtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-25433)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/issues/520)\n- [cve@mitre.org](https://gitlab.com/libtiff/libtiff/-/merge_requests/467)\n- [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n", "disclosureTime": "2023-06-29T20:15:09.830000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.08313", "probability": "0.00044" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5767899", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-25433" ], "CWE": [ "CWE-120" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-01T13:10:43.055889Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-07-08T15:36:56.802594Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-25433" }, { "title": "cve@mitre.org", "url": "https://gitlab.com/libtiff/libtiff/-/issues/520" }, { "title": "cve@mitre.org", "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/467" }, { "title": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Buffer Overflow", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cpes": [], "creationTime": "2023-07-12T15:50:25.898547Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-08-09T13:52:54.158549Z", "severity": "medium" }, { "assigner": "NVD", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-07-21T01:12:29.845865Z", "severity": "medium" } ], "cvssScore": 6.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `tiff` package and not the `tiff` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-3618)\n- [secalert@redhat.com](https://access.redhat.com/security/cve/CVE-2023-3618)\n- [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2215865)\n- [secalert@redhat.com](https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20230824-0012/)\n", "disclosureTime": "2023-07-12T15:15:09.060000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.14419", "probability": "0.00047" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5773187", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-3618" ], "CWE": [ "CWE-120" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-25T01:10:53.786574Z", "name": "tiff/libtiff6", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-07-12T15:50:25.879005Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-3618" }, { "title": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2023-3618" }, { "title": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215865" }, { "title": "secalert@redhat.com", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20230824-0012/" } ], "relativeImportance": "minor issue", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Buffer Overflow", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-07-25T14:50:11.605240Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-07-24T14:12:55.541722Z", "severity": "medium" } ], "cvssScore": null, "description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-38288)\n", "disclosureTime": null, "epssDetails": null, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5804844", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-38288" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-07-25T14:50:11.605267Z", "name": "tiff/libtiff6", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-07-25T14:50:01.272663Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-38288" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-38288", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-07-25T14:50:24.383752Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "Red Hat", "cvssV3BaseScore": 6.5, "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modificationTime": "2023-07-24T14:12:47.076929Z", "severity": "medium" } ], "cvssScore": null, "description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-38289)\n", "disclosureTime": null, "epssDetails": null, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5804846", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-38289" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-07-25T14:50:24.383780Z", "name": "tiff/libtiff6", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-07-25T14:49:55.862673Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-38289" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-38289", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-08-29T02:14:12.065902Z", "credit": [ "" ], "cvssDetails": [], "cvssScore": null, "description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-40745)\n", "disclosureTime": null, "epssDetails": null, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5862859", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-40745" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-29T02:14:12.065914Z", "name": "tiff/libtiff6", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-08-29T02:14:12.010192Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-40745" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-40745", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": null, "cpes": [], "creationTime": "2023-08-29T02:15:15.690236Z", "credit": [ "" ], "cvssDetails": [], "cvssScore": null, "description": "## NVD Description\n_This vulnerability has not been analyzed by NVD yet._\n\n## Remediation\nThere is no fixed version for `Debian:12` `tiff`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2023-41175)\n", "disclosureTime": null, "epssDetails": null, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "nginx-module-image-filter@1.25.2-1~bookworm", "libgd2/libgd3@2.3.3-9", "tiff/libtiff6@4.5.0-6" ], "id": "SNYK-DEBIAN12-TIFF-5862863", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2023-41175" ], "CWE": [] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-08-29T02:15:15.690263Z", "name": "tiff/libtiff6", "nvdSeverity": null, "packageManager": "debian:12", "packageName": "tiff", "patches": [], "publicationTime": "2023-08-29T02:14:21.842855Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2023-41175" } ], "relativeImportance": "not yet assigned", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "CVE-2023-41175", "upgradePath": [], "version": "4.5.0-6" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/libblkid1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libblkid1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "e2fsprogs@1.47.0-2", "util-linux/libblkid1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libblkid1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/libmount1@2.38.1-5+b1", "util-linux/libblkid1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libblkid1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/mount@2.38.1-5+b1", "util-linux/libblkid1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libblkid1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "util-linux/libblkid1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libblkid1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/libuuid1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libuuid1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "e2fsprogs@1.47.0-2", "util-linux/libuuid1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libuuid1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "util-linux/libuuid1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libuuid1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/bsdutils@1:2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/bsdutils", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "1:2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/libmount1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libmount1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/mount@2.38.1-5+b1", "util-linux/libmount1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libmount1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "util-linux/libmount1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libmount1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/libsmartcols1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libsmartcols1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/mount@2.38.1-5+b1", "util-linux/libsmartcols1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libsmartcols1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "util-linux/libsmartcols1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libsmartcols1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "util-linux/util-linux-extra@2.38.1-5+b1", "util-linux/libsmartcols1@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/libsmartcols1", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/mount@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/mount", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux-extra@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/util-linux-extra", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1", "util-linux/util-linux-extra@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/util-linux-extra", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" }, { "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cpes": [], "creationTime": "2022-02-15T03:53:14.467208Z", "credit": [ "" ], "cvssDetails": [ { "assigner": "NVD", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-06-04T01:10:58.797557Z", "severity": "medium" }, { "assigner": "Red Hat", "cvssV3BaseScore": 5.5, "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modificationTime": "2022-11-27T21:31:47.261249Z", "severity": "medium" } ], "cvssScore": 5.5, "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian:12`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [ADVISORY](https://security-tracker.debian.org/tracker/CVE-2022-0563)\n- [secalert@redhat.com](https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u)\n- [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20220331-0002/)\n", "disclosureTime": "2022-02-21T19:15:08.393000Z", "epssDetails": { "modelVersion": "v2023.03.01", "percentile": "0.07034", "probability": "0.00043" }, "exploit": "Not Defined", "from": [ "docker-image|cyberdojo/nginx@e29d5d9", "util-linux/util-linux@2.38.1-5+b1" ], "id": "SNYK-DEBIAN12-UTILLINUX-2401083", "identifiers": { "ALTERNATIVE": [], "CVE": [ "CVE-2022-0563" ], "CWE": [ "CWE-209" ] }, "insights": { "triageAdvice": null }, "isDisputed": false, "isPatchable": false, "isUpgradable": false, "language": "linux", "malicious": false, "modificationTime": "2023-02-14T13:36:57.882613Z", "name": "util-linux/util-linux", "nvdSeverity": "medium", "packageManager": "debian:12", "packageName": "util-linux", "patches": [], "publicationTime": "2022-02-15T03:52:31.478601Z", "references": [ { "title": "ADVISORY", "url": "https://security-tracker.debian.org/tracker/CVE-2022-0563" }, { "title": "secalert@redhat.com", "url": "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/%23u" }, { "title": "secalert@redhat.com", "url": "https://security.netapp.com/advisory/ntap-20220331-0002/" } ], "relativeImportance": "unimportant", "semver": { "vulnerable": [ "*" ] }, "severity": "low", "severityWithCritical": "low", "socialTrendAlert": false, "title": "Information Exposure", "upgradePath": [], "version": "2.38.1-5+b1" } ] }, "created_at": 1694616253.007147, "has_audit_package": true }