Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

7 vulnerabilities found for m10-4s by fujitsu

VAR-202012-1278

Vulnerability from variot - Updated: 2026-03-09 22:04

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. HAXX libcurl is an open source client-side URL transfer library developed by Haxx (HAXX) in Sweden. The product supports protocols such as FTP, SFTP, TFTP and HTTP. A security vulnerability exists in libcurl that could be exploited by an attacker to trigger a fatal error via libcurl's FTP wildcards, thereby triggering a denial of service. A security issue was found in curl versions 7.21.0 up to and including 7.73.0. libcurl offers a wildcard matching functionality, which allows a callback (set with CURLOPT_CHUNK_BGN_FUNCTION) to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns CURL_CHUNK_BGN_FUNC_SKIP, to tell libcurl to not deal with that file, the internal function in libcurl then calls itself recursively to handle the next directory entry. If there's a sufficient amount of file entries and if the callback returns "skip" enough number of times, libcurl runs out of stack space. The exact amount will of course vary with platforms, compilers and other environmental factors. The content of the remote directory is not kept on the stack, so it seems hard for the malicious user to control exactly what data that overwrites the stack - however it remains a Denial-Of-Service vector as a malicious user who controls a server that a libcurl-using application works with under these premises can trigger a crash. Description:

Red Hat Advanced Cluster Management for Kubernetes 2.2.4 images

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana gement_for_kubernetes/2.2/html/release_notes/

Security fixes:

redisgraph-tls: redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms (CVE-2021-21309)
console-header-container: nodejs-netmask: improper input validation of octal input data (CVE-2021-28092)
console-container: nodejs-is-svg: ReDoS via malicious string (CVE-2021-28918)

Bug fixes:

RHACM 2.2.4 images (BZ# 1957254)
Enabling observability for OpenShift Container Storage with RHACM 2.2 on OCP 4.7 (BZ#1950832)
ACM Operator should support using the default route TLS (BZ# 1955270)
The scrolling bar for search filter does not work properly (BZ# 1956852)
Limits on Length of MultiClusterObservability Resource Name (BZ# 1959426)
The proxy setup in install-config.yaml is not worked when IPI installing with RHACM (BZ# 1960181)
Unable to make SSH connection to a Bitbucket server (BZ# 1966513)
Observability Thanos store shard crashing - cannot unmarshall DNS message (BZ# 1967890)
Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):

1932634 - CVE-2021-21309 redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms 1939103 - CVE-2021-28092 nodejs-is-svg: ReDoS via malicious string 1944827 - CVE-2021-28918 nodejs-netmask: improper input validation of octal input data 1950832 - Enabling observability for OpenShift Container Storage with RHACM 2.2 on OCP 4.7 1952150 - [DDF] It would be great to see all the options available for the bucket configuration and which attributes are mandatory 1954506 - [DDF] Table does not contain data about 20 clusters. Now it's difficult to estimate CPU usage with larger clusters 1954535 - Reinstall Submariner - No endpoints found on one cluster 1955270 - ACM Operator should support using the default route TLS 1956852 - The scrolling bar for search filter does not work properly 1957254 - RHACM 2.2.4 images 1959426 - Limits on Length of MultiClusterObservability Resource Name 1960181 - The proxy setup in install-config.yaml is not worked when IPI installing with RHACM. 1963128 - [DDF] Please rename this to "Amazon Elastic Kubernetes Service" 1966513 - Unable to make SSH connection to a Bitbucket server 1967357 - [DDF] When I clicked on this yaml, I get a HTTP 404 error. 1967890 - Observability Thanos store shard crashing - cannot unmarshal DNS message

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

===================================================================== Red Hat Security Advisory

Synopsis: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update Advisory ID: RHSA-2021:2471-01 Product: Red Hat JBoss Core Services Advisory URL: https://access.redhat.com/errata/RHSA-2021:2471 Issue date: 2021-06-17 CVE Names: CVE-2020-8169 CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 CVE-2021-22876 CVE-2021-22890 CVE-2021-22901 CVE-2021-31618 =====================================================================

Summary:

Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 8 zip release for RHEL 7, RHEL 8 and Microsoft Windows is available.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.

This release adds the new Apache HTTP Server 2.4.37 Service Pack 8 packages that are part of the JBoss Core Services offering.

This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 7 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.

Security Fix(es):

curl: Use-after-free in TLS session handling when using OpenSSL TLS backend (CVE-2021-22901)
httpd: NULL pointer dereference on specially crafted HTTP/2 request (CVE-2021-31618)
libcurl: partial password leak over DNS on HTTP redirect (CVE-2020-8169)
curl: FTP PASV command response can cause curl to connect to arbitrary host (CVE-2020-8284)
curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used (CVE-2020-8285)
curl: Inferior OCSP verification (CVE-2020-8286)
curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)
curl: TLS 1.3 session ticket mix-up with HTTPS proxy host (CVE-2021-22890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.

Bugs fixed (https://bugzilla.redhat.com/):

1847916 - CVE-2020-8169 libcurl: partial password leak over DNS on HTTP redirect 1902667 - CVE-2020-8284 curl: FTP PASV command response can cause curl to connect to arbitrary host 1902687 - CVE-2020-8285 curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used 1906096 - CVE-2020-8286 curl: Inferior OCSP verification 1941964 - CVE-2021-22876 curl: Leak of authentication credentials in URL via automatic Referer 1941965 - CVE-2021-22890 curl: TLS 1.3 session ticket mix-up with HTTPS proxy host 1963146 - CVE-2021-22901 curl: Use-after-free in TLS session handling when using OpenSSL TLS backend 1968013 - CVE-2021-31618 httpd: NULL pointer dereference on specially crafted HTTP/2 request

References:

https://access.redhat.com/security/cve/CVE-2020-8169 https://access.redhat.com/security/cve/CVE-2020-8284 https://access.redhat.com/security/cve/CVE-2020-8285 https://access.redhat.com/security/cve/CVE-2020-8286 https://access.redhat.com/security/cve/CVE-2021-22876 https://access.redhat.com/security/cve/CVE-2021-22890 https://access.redhat.com/security/cve/CVE-2021-22901 https://access.redhat.com/security/cve/CVE-2021-31618 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp&downloadType=securityPatches&version=2.4.37 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.openssl&downloadType=securityPatches&version=1.1.1g https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iQIVAwUBYMszstzjgjWX9erEAQgW2Q//cZOMa4KOvz7KejR03sHk7m8aMHDRdPDe Ki6PTe99phprmuXNPOCPGFuWDXbdpAlyEx3Elt3Ah+vmpV+K7ThwXGXJkGwb6mol 2xAFvcwxxO6GNsCl8gYW+JTG+5HYLZ/U4q3lgHId9qfzmuRRg0zwOuwZC7y7R6kP 3H1o1WRiIKEA1oHCh3f3OizTrkOcBZsWINsJ2ggW+ZqVeve4PJH55F3JwCJbIuhd kUhe1QQjiANWq4m/+QkTRtIYzahqK+lIubpoU5P+sFosc7ASUGe29ZPC9LsfY4hx 61bSxXbxTv2wcBaUrg/TAxRplQdHRbZe8s8eWhMtDoNHRqujYOiKHUnBgdoY6oLd 3gfAGI3w2NnWRDodGDGXfuDu6hncAukvxqOO/tOnRd2n7/R52ewGCsNKvsf/OHRG 1X7UeD4DJvXiqBNOtPaqOjR3q7xdO5MhYtkvh/8mzvhx5X/CojUWRWmtSdJDhpvQ POl+hJjFqEFTUJk/VGDJ7HsIs5OqeoV0pURP3VvYyBF75xp3aYI8Gfb1wLoqXmp2 iFhSTskqEc42iMvG/Ks5Rb1wQLrJ4RNgxunGofmNQusjgN406aAqvE79a6JUmt/z 7Z6i8Tvy9PGgNtbnalyxbikpA8Qcoxoij2pbIcSNIJXW+mA74QtI3AC4+4m0V90H butyhmDY1nQ= =gsJD -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically. Applications using the APR libraries, such as httpd, must be restarted for this update to take effect. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Gentoo Linux Security Advisory GLSA 202012-14

                                        https://security.gentoo.org/

Severity: Normal Title: cURL: Multiple vulnerabilities Date: December 23, 2020 Bugs: #737990, #759259 ID: 202012-14

Synopsis

Multiple vulnerabilities have been found in cURL, the worst of which could result in information disclosure or data loss.

Background

A command line tool and library for transferring data with URLs.

Affected packages

 -------------------------------------------------------------------
  Package              /     Vulnerable     /            Unaffected
 -------------------------------------------------------------------

1 net-misc/curl < 7.74.0 >= 7.74.0

Description

Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All cURL users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.74.0"

References

[ 1 ] CVE-2020-8231 https://nvd.nist.gov/vuln/detail/CVE-2020-8231 [ 2 ] CVE-2020-8284 https://nvd.nist.gov/vuln/detail/CVE-2020-8284 [ 3 ] CVE-2020-8285 https://nvd.nist.gov/vuln/detail/CVE-2020-8285 [ 4 ] CVE-2020-8286 https://nvd.nist.gov/vuln/detail/CVE-2020-8286

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/202012-14

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

APPLE-SA-2021-04-26-2 macOS Big Sur 11.3

macOS Big Sur 11.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212325.

APFS Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: A logic issue was addressed with improved state management. CVE-2021-1853: Gary Nield of ECSC Group plc and Tim Michaud(@TimGMichaud) of Zoom Video Communications

AppleMobileFileIntegrity Available for: macOS Big Sur Impact: A malicious application may be able to bypass Privacy preferences Description: An issue in code signature validation was addressed with improved checks. CVE-2021-1849: Siguza

Apple Neural Engine Available for: macOS Big Sur Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1867: Zuozhi Fan (@pattern_F_) and Wish Wu(吴潍浠) of Ant Group Tianqiong Security Lab

Archive Utility Available for: macOS Big Sur Impact: A malicious application may bypass Gatekeeper checks Description: A logic issue was addressed with improved state management. CVE-2021-1810: an anonymous researcher

Audio Available for: macOS Big Sur Impact: An application may be able to read restricted memory Description: A memory corruption issue was addressed with improved validation. CVE-2021-1808: JunDong Xie of Ant Security Light-Year Lab

CFNetwork Available for: macOS Big Sur Impact: Processing maliciously crafted web content may disclose sensitive user information Description: A memory initialization issue was addressed with improved memory handling. CVE-2021-1857: an anonymous researcher

CoreAudio Available for: macOS Big Sur Impact: Processing a maliciously crafted audio file may disclose restricted memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1846: JunDong Xie of Ant Security Light-Year Lab

CoreAudio Available for: macOS Big Sur Impact: A malicious application may be able to read restricted memory Description: A memory corruption issue was addressed with improved validation. CVE-2021-1809: JunDong Xie of Ant Security Light-Year Lab

CoreFoundation Available for: macOS Big Sur Impact: A malicious application may be able to leak sensitive user information Description: A validation issue was addressed with improved logic. CVE-2021-30659: Thijs Alkemade of Computest

CoreGraphics Available for: macOS Big Sur Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved validation. CVE-2021-1847: Xuwei Liu of Purdue University

CoreText Available for: macOS Big Sur Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: A logic issue was addressed with improved state management. CVE-2021-1811: Xingwei Lin of Ant Security Light-Year Lab

curl Available for: macOS Big Sur Impact: An attacker may provide a fraudulent OCSP response that would appear valid Description: This issue was addressed with improved checks. CVE-2020-8286: an anonymous researcher

curl Available for: macOS Big Sur Impact: A remote attacker may be able to cause a denial of service Description: A buffer overflow was addressed with improved input validation. CVE-2020-8285: xnynx

DiskArbitration Available for: macOS Big Sur Impact: A malicious application may be able to modify protected parts of the file system Description: A permissions issue existed in DiskArbitration. This was addressed with additional ownership checks. CVE-2021-1784: Mikko Kenttälä (@Turmio_) of SensorFu, Csaba Fitzl (@theevilbit) of Offensive Security, and an anonymous researcher

FaceTime Available for: macOS Big Sur Impact: Muting a CallKit call while ringing may not result in mute being enabled Description: A logic issue was addressed with improved state management. CVE-2021-1872: Siraj Zaneer of Facebook

FontParser Available for: macOS Big Sur Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-1881: an anonymous researcher, Xingwei Lin of Ant Security Light-Year Lab, Mickey Jin of Trend Micro, and Hou JingYi (@hjy79425575) of Qihoo 360

Foundation Available for: macOS Big Sur Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved validation. CVE-2021-1882: Gabe Kirkpatrick (@gabe_k)

Foundation Available for: macOS Big Sur Impact: A malicious application may be able to gain root privileges Description: A validation issue was addressed with improved logic. CVE-2021-1813: Cees Elzinga

Heimdal Available for: macOS Big Sur Impact: Processing maliciously crafted server messages may lead to heap corruption Description: This issue was addressed with improved checks. CVE-2021-1883: Gabe Kirkpatrick (@gabe_k)

Heimdal Available for: macOS Big Sur Impact: A remote attacker may be able to cause a denial of service Description: A race condition was addressed with improved locking. CVE-2021-1884: Gabe Kirkpatrick (@gabe_k)

ImageIO Available for: macOS Big Sur Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: This issue was addressed with improved checks. CVE-2021-1880: Xingwei Lin of Ant Security Light-Year Lab CVE-2021-30653: Ye Zhang of Baidu Security CVE-2021-1814: Ye Zhang of Baidu Security, Mickey Jin & Qi Sun of Trend Micro, and Xingwei Lin of Ant Security Light-Year Lab CVE-2021-1843: Ye Zhang of Baidu Security

ImageIO Available for: macOS Big Sur Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-1885: CFF of Topsec Alpha Team

ImageIO Available for: macOS Big Sur Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2021-1858: Mickey Jin of Trend Micro

Installer Available for: macOS Big Sur Impact: A malicious application may bypass Gatekeeper checks Description: This issue was addressed with improved handling of file metadata. CVE-2021-30658: Wojciech Reguła (@_r3ggi) of SecuRing

Intel Graphics Driver Available for: macOS Big Sur Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2021-1841: Jack Dates of RET2 Systems, Inc. CVE-2021-1834: ABC Research s.r.o. working with Trend Micro Zero Day Initiative

Kernel Available for: macOS Big Sur Impact: A malicious application may be able to disclose kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2021-1860: @0xalsr

Kernel Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: A memory corruption issue was addressed with improved validation. CVE-2021-1840: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong Security Lab

Kernel Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with kernel privileges Description: A logic issue was addressed with improved state management. CVE-2021-1851: @0xalsr

Kernel Available for: macOS Big Sur Impact: Copied files may not have the expected file permissions Description: The issue was addressed with improved permissions logic. CVE-2021-1832: an anonymous researcher

Kernel Available for: macOS Big Sur Impact: A malicious application may be able to disclose kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-30660: Alex Plaskett

libxpc Available for: macOS Big Sur Impact: A malicious application may be able to gain root privileges Description: A race condition was addressed with additional validation. CVE-2021-30652: James Hutchins

libxslt Available for: macOS Big Sur Impact: Processing a maliciously crafted file may lead to heap corruption Description: A double free issue was addressed with improved memory management. CVE-2021-1875: Found by OSS-Fuzz

Login Window Available for: macOS Big Sur Impact: A malicious application with root privileges may be able to access private information Description: This issue was addressed with improved entitlements. CVE-2021-1824: Wojciech Reguła (@_r3ggi) of SecuRing

Notes Available for: macOS Big Sur Impact: Locked Notes content may have been unexpectedly unlocked Description: A logic issue was addressed with improved state management. CVE-2021-1859: Syed Ali Shuja (@SyedAliShuja) of Colour King Pvt. Ltd

NSRemoteView Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2021-1876: Matthew Denton of Google Chrome

Preferences Available for: macOS Big Sur Impact: A local user may be able to modify protected parts of the file system Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2021-1815: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) CVE-2021-1739: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) CVE-2021-1740: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com)

Safari Available for: macOS Big Sur Impact: A malicious website may be able to track users by setting state in a cache Description: An issue existed in determining cache occupancy. The issue was addressed through improved logic. CVE-2021-1861: Konstantinos Solomos of University of Illinois at Chicago

Safari Available for: macOS Big Sur Impact: A malicious website may be able to force unnecessary network connections to fetch its favicon Description: A logic issue was addressed with improved state management. CVE-2021-1855: Håvard Mikkelsen Ottestad of HASMAC AS

SampleAnalysis Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: A logic issue was addressed with improved state management. CVE-2021-1868: Tim Michaud of Zoom Communications

smbx Available for: macOS Big Sur Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: An integer overflow was addressed with improved input validation. CVE-2021-1878: Aleksandar Nikolic of Cisco Talos (talosintelligence.com)

System Preferences Available for: macOS Big Sur Impact: A malicious application may bypass Gatekeeper checks Description: A logic issue was addressed with improved state management. CVE-2021-30657: an anonymous researcher

tcpdump Available for: macOS Big Sur Impact: A remote attacker may be able to cause a denial of service Description: This issue was addressed with improved checks. CVE-2020-8037: an anonymous researcher

Time Machine Available for: macOS Big Sur Impact: A local attacker may be able to elevate their privileges Description: The issue was addressed with improved permissions logic. CVE-2021-1839: Tim Michaud(@TimGMichaud) of Zoom Video Communications and Gary Nield of ECSC Group plc

WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to a cross site scripting attack Description: An input validation issue was addressed with improved input validation. CVE-2021-1825: Alex Camboe of Aon’s Cyber Solutions

WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved state management. CVE-2021-1817: an anonymous researcher

WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue was addressed with improved restrictions. CVE-2021-1826: an anonymous researcher

WebKit Available for: macOS Big Sur Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2021-1820: an anonymous researcher

WebKit Storage Available for: macOS Big Sur Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A use after free issue was addressed with improved memory management. CVE-2021-30661: yangkang(@dnpushme) of 360 ATA

WebRTC Available for: macOS Big Sur Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2020-7463: Megan2013678

Wi-Fi Available for: macOS Big Sur Impact: An application may be able to cause unexpected system termination or write kernel memory Description: A memory corruption issue was addressed with improved validation. CVE-2021-1828: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong Security Lab

Wi-Fi Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with kernel privileges Description: A type confusion issue was addressed with improved state handling. CVE-2021-1829: Tielei Wang of Pangu Lab

Wi-Fi Available for: macOS Big Sur Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2021-30655: Gary Nield of ECSC Group plc and Tim Michaud(@TimGMichaud) of Zoom Video Communications and Wojciech Reguła (@_r3ggi) of SecuRing

Windows Server Available for: macOS Big Sur Impact: A malicious application may be able to unexpectedly leak a user's credentials from secure text fields Description: An API issue in Accessibility TCC permissions was addressed with improved state management. CVE-2021-1873: an anonymous researcher

Installation note:

This update may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/

Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAmCHO0UACgkQZcsbuWJ6 jjA/XA/7BDDpbLo0btLbUrps6ELmcqFZhpvhuekw8Yd3jVeJihLcJGJpY38ZCcne srCJHuXPzlk3ex0bVkKNRrB04xF0vCA4TEBsJ495754PAKWrxmlx0Ce8zg4h+ey/ cMTaUgfB1sgOFO8kJCKJurCjhyQ3Xj5c5xa8/zxlKoAgI36PmhZsCoXC6KD+5mqn QCRF0kE/y0QSfsq13j4grLGMXLS4pkAJRMWvDiEliYDTw3pOul7ZDOwxLEyucVTv fE60H7ff7jfPbDcQ4yEgEbla40+YZYwl9Sv4zxIU2OBPva6HLbA+PXxk4F1QX7eA ECrfycMSIbQKZ2phryENZCcrX5DN4M/VcGIHq4ujF2CXBJymSWV0O5k5K0GzZ0Ko T2Zr2LOOunvHGrYy0okholNYb0iMA09dvwuDdEGr+vhLZhq1BBbmThhNEnArl7mE /fx2bvaS3o8TxGuh7mbeFK9q5Tafxe5Qhwgz9pnAtqBC8z1NgQoetk9pKPNDIsNY t3/7Xcix+fs28YOjmxPTpntud0EGSjxXm4g0bDbsU922iV1Z3ncgOvd//IzPXniS v4IqR/gPbhg+c2CGoaezD91sE5onLuMmFCogkUyftGHnN0EueKMjI+3fmyG4l4d1 0C3to6hKJNmTm56RgxwfVVOeVnsPF490s9LUYzO4ZUbaQHIuDfo= =9+Ju -----END PGP SIGNATURE-----

. ========================================================================== Ubuntu Security Notice USN-4665-2 December 09, 2020

curl vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 14.04 ESM
Ubuntu 12.04 ESM

Summary:

Several security issues were fixed in curl.

Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries

Details:

USN-4665-1 fixed several vulnerabilities in curl. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Varnavas Papaioannou discovered that curl incorrectly handled FTP PASV responses. An attacker could possibly use this issue to trick curl into connecting to an arbitrary IP address and be used to perform port scanner and other information gathering. (CVE-2020-8284)

It was discovered that curl incorrectly handled FTP wildcard matchins. (CVE-2020-8285)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 ESM: curl 7.35.0-1ubuntu2.20+esm6 libcurl3 7.35.0-1ubuntu2.20+esm6 libcurl3-gnutls 7.35.0-1ubuntu2.20+esm6 libcurl3-nss 7.35.0-1ubuntu2.20+esm6

Ubuntu 12.04 ESM: curl 7.22.0-3ubuntu4.29 libcurl3 7.22.0-3ubuntu4.29 libcurl3-gnutls 7.22.0-3ubuntu4.29 libcurl3-nss 7.22.0-3ubuntu4.29

In general, a standard system update will make all the necessary changes

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202012-1278",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "33"
      },
      {
        "model": "hci storage node",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "libcurl",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "haxx",
        "version": "7.21.0"
      },
      {
        "model": "essbase",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "21.2"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "10.0"
      },
      {
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "model": "clustered data ontap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "universal forwarder",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "8.2.12"
      },
      {
        "model": "macos",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "11.3"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.15.7"
      },
      {
        "model": "communications billing and revenue management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0.3.0"
      },
      {
        "model": "sinec infrastructure network services",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "1.0.1.1"
      },
      {
        "model": "macos",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "11.0"
      },
      {
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "model": "mac os x",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.15"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.14.6"
      },
      {
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "model": "universal forwarder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "9.1.0"
      },
      {
        "model": "libcurl",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "haxx",
        "version": "7.74.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "32"
      },
      {
        "model": "universal forwarder",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "9.0.6"
      },
      {
        "model": "solidfire",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "peoplesoft enterprise peopletools",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.58"
      },
      {
        "model": "universal forwarder",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "9.0.0"
      },
      {
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "model": "universal forwarder",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "8.2.0"
      },
      {
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "model": "mac os x",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.15.7"
      },
      {
        "model": "hci management node",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "model": "mac os x",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.14.6"
      },
      {
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "model": "hci bootstrap os",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "model": "communications cloud native core policy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.14.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-8285"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "163188"
      },
      {
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2020-8285",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2020-8285",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.1,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-186410",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2020-8285",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-8285",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202012-756",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-186410",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-8285",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186410"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8285"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8285"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. HAXX libcurl is an open source client-side URL transfer library developed by Haxx (HAXX) in Sweden. The product supports protocols such as FTP, SFTP, TFTP and HTTP. A security vulnerability exists in libcurl that could be exploited by an attacker to trigger a fatal error via libcurl\u0027s FTP wildcards, thereby triggering a denial of service. A security issue was found in curl versions 7.21.0 up to and including 7.73.0. libcurl offers a wildcard matching functionality, which allows a callback (set with CURLOPT_CHUNK_BGN_FUNCTION) to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns CURL_CHUNK_BGN_FUNC_SKIP, to tell libcurl to not deal with that file, the internal function in libcurl then calls itself recursively to handle the next directory entry. If there\u0027s a sufficient amount of file entries and if the callback returns \"skip\" enough number of times, libcurl runs out of stack space. The exact amount will of course vary with platforms, compilers and other environmental factors. The content of the remote directory is not kept on the stack, so it seems hard for the malicious user to control exactly what data that overwrites the stack - however it remains a Denial-Of-Service vector as a malicious user who controls a server that a libcurl-using application works with under these premises can trigger a crash. Description:\n\nRed Hat Advanced Cluster Management for Kubernetes 2.2.4 images\n\nRed Hat Advanced Cluster Management for Kubernetes provides the\ncapabilities to address common challenges that administrators and site\nreliability\nengineers face as they work across a range of public and private cloud\nenvironments. \nClusters and applications are all visible and managed from a single\nconsole\u2014with security policy built in. See\nthe following Release Notes documentation, which will be updated shortly\nfor\nthis release, for additional details about this release:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana\ngement_for_kubernetes/2.2/html/release_notes/\n\nSecurity fixes:\n\n* redisgraph-tls: redis: integer overflow when configurable limit for\nmaximum supported bulk input size is too big on 32-bit platforms\n(CVE-2021-21309)\n\n* console-header-container: nodejs-netmask: improper input validation of\noctal input data (CVE-2021-28092)\n\n* console-container: nodejs-is-svg: ReDoS via malicious string\n(CVE-2021-28918)\n\nBug fixes: \n\n* RHACM 2.2.4 images (BZ# 1957254)\n\n* Enabling observability for OpenShift Container Storage with RHACM 2.2 on\nOCP 4.7 (BZ#1950832)\n\n* ACM Operator should support using the default route TLS (BZ# 1955270)\n\n* The scrolling bar for search filter does not work properly (BZ# 1956852)\n\n* Limits on Length of MultiClusterObservability Resource Name (BZ# 1959426)\n\n* The proxy setup in install-config.yaml is not worked when IPI installing\nwith RHACM (BZ# 1960181)\n\n* Unable to make SSH connection to a Bitbucket server (BZ# 1966513)\n\n* Observability Thanos store shard crashing - cannot unmarshall DNS message\n(BZ# 1967890)\n\n3. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):\n\n1932634 - CVE-2021-21309 redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms\n1939103 - CVE-2021-28092 nodejs-is-svg: ReDoS via malicious string\n1944827 - CVE-2021-28918 nodejs-netmask: improper input validation of octal input data\n1950832 - Enabling observability for OpenShift Container Storage with RHACM 2.2 on OCP 4.7\n1952150 - [DDF] It would be great to see all the options available for the bucket configuration and which attributes are mandatory\n1954506 - [DDF] Table does not contain data about 20 clusters. Now it\u0027s difficult to estimate CPU usage with larger clusters\n1954535 - Reinstall Submariner - No endpoints found on one cluster\n1955270 - ACM Operator should support using the default route TLS\n1956852 - The scrolling bar for search filter does not work properly\n1957254 - RHACM 2.2.4 images\n1959426 - Limits on Length of MultiClusterObservability Resource Name\n1960181 - The proxy setup in install-config.yaml is not worked when IPI installing with RHACM. \n1963128 - [DDF] Please rename this to \"Amazon Elastic Kubernetes Service\"\n1966513 - Unable to make SSH connection to a Bitbucket server\n1967357 - [DDF] When I clicked on this yaml, I get a HTTP 404 error. \n1967890 - Observability Thanos store shard crashing - cannot unmarshal DNS message\n\n5. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update\nAdvisory ID:       RHSA-2021:2471-01\nProduct:           Red Hat JBoss Core Services\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2021:2471\nIssue date:        2021-06-17\nCVE Names:         CVE-2020-8169 CVE-2020-8284 CVE-2020-8285 \n                   CVE-2020-8286 CVE-2021-22876 CVE-2021-22890 \n                   CVE-2021-22901 CVE-2021-31618 \n=====================================================================\n\n1. Summary:\n\nRed Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 8 zip\nrelease for RHEL 7, RHEL 8 and Microsoft Windows is available. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat JBoss Core Services is a set of supplementary software for Red Hat\nJBoss middleware products. This software, such as Apache HTTP Server, is\ncommon to multiple JBoss middleware products, and is packaged under Red Hat\nJBoss Core Services to allow for faster distribution of updates, and for a\nmore consistent update experience. \n\nThis release adds the new Apache HTTP Server 2.4.37 Service Pack 8 packages\nthat are part of the JBoss Core Services offering. \n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack\nApache Server 2.4.37 Service Pack 7 and includes bug fixes and\nenhancements. Refer to the Release Notes for information on the most\nsignificant bug fixes and enhancements included in this release. \n\nSecurity Fix(es):\n\n* curl: Use-after-free in TLS session handling when using OpenSSL TLS\nbackend (CVE-2021-22901)\n\n* httpd: NULL pointer dereference on specially crafted HTTP/2 request\n(CVE-2021-31618)\n\n* libcurl: partial password leak over DNS on HTTP redirect (CVE-2020-8169)\n\n* curl: FTP PASV command response can cause curl to connect to arbitrary\nhost (CVE-2020-8284)\n\n* curl: Malicious FTP server can trigger stack overflow when\nCURLOPT_CHUNK_BGN_FUNCTION is used (CVE-2020-8285)\n\n* curl: Inferior OCSP verification (CVE-2020-8286)\n\n* curl: Leak of authentication credentials in URL via automatic Referer\n(CVE-2021-22876)\n\n* curl: TLS 1.3 session ticket mix-up with HTTPS proxy host\n(CVE-2021-22890)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nThe References section of this erratum contains a download link for the\nupdate. You must be logged in to download the update. \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1847916 - CVE-2020-8169 libcurl: partial password leak over DNS on HTTP redirect\n1902667 - CVE-2020-8284 curl: FTP PASV command response can cause curl to connect to arbitrary host\n1902687 - CVE-2020-8285 curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used\n1906096 - CVE-2020-8286 curl: Inferior OCSP verification\n1941964 - CVE-2021-22876 curl: Leak of authentication credentials in URL via automatic Referer\n1941965 - CVE-2021-22890 curl: TLS 1.3 session ticket mix-up with HTTPS proxy host\n1963146 - CVE-2021-22901 curl: Use-after-free in TLS session handling when using OpenSSL TLS backend\n1968013 - CVE-2021-31618 httpd: NULL pointer dereference on specially crafted HTTP/2 request\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2020-8169\nhttps://access.redhat.com/security/cve/CVE-2020-8284\nhttps://access.redhat.com/security/cve/CVE-2020-8285\nhttps://access.redhat.com/security/cve/CVE-2020-8286\nhttps://access.redhat.com/security/cve/CVE-2021-22876\nhttps://access.redhat.com/security/cve/CVE-2021-22890\nhttps://access.redhat.com/security/cve/CVE-2021-22901\nhttps://access.redhat.com/security/cve/CVE-2021-31618\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp\u0026downloadType=securityPatches\u0026version=2.4.37\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.openssl\u0026downloadType=securityPatches\u0026version=1.1.1g\nhttps://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYMszstzjgjWX9erEAQgW2Q//cZOMa4KOvz7KejR03sHk7m8aMHDRdPDe\nKi6PTe99phprmuXNPOCPGFuWDXbdpAlyEx3Elt3Ah+vmpV+K7ThwXGXJkGwb6mol\n2xAFvcwxxO6GNsCl8gYW+JTG+5HYLZ/U4q3lgHId9qfzmuRRg0zwOuwZC7y7R6kP\n3H1o1WRiIKEA1oHCh3f3OizTrkOcBZsWINsJ2ggW+ZqVeve4PJH55F3JwCJbIuhd\nkUhe1QQjiANWq4m/+QkTRtIYzahqK+lIubpoU5P+sFosc7ASUGe29ZPC9LsfY4hx\n61bSxXbxTv2wcBaUrg/TAxRplQdHRbZe8s8eWhMtDoNHRqujYOiKHUnBgdoY6oLd\n3gfAGI3w2NnWRDodGDGXfuDu6hncAukvxqOO/tOnRd2n7/R52ewGCsNKvsf/OHRG\n1X7UeD4DJvXiqBNOtPaqOjR3q7xdO5MhYtkvh/8mzvhx5X/CojUWRWmtSdJDhpvQ\nPOl+hJjFqEFTUJk/VGDJ7HsIs5OqeoV0pURP3VvYyBF75xp3aYI8Gfb1wLoqXmp2\niFhSTskqEc42iMvG/Ks5Rb1wQLrJ4RNgxunGofmNQusjgN406aAqvE79a6JUmt/z\n7Z6i8Tvy9PGgNtbnalyxbikpA8Qcoxoij2pbIcSNIJXW+mA74QtI3AC4+4m0V90H\nbutyhmDY1nQ=\n=gsJD\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted\nautomatically. Applications using the APR libraries, such as httpd, must be\nrestarted for this update to take effect.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 202012-14\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                            https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n  Severity: Normal\n     Title: cURL: Multiple vulnerabilities\n      Date: December 23, 2020\n      Bugs: #737990, #759259\n        ID: 202012-14\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in cURL, the worst of which\ncould result in information disclosure or data loss. \n\nBackground\n==========\n\nA command line tool and library for transferring data with URLs. \n\nAffected packages\n=================\n\n     -------------------------------------------------------------------\n      Package              /     Vulnerable     /            Unaffected\n     -------------------------------------------------------------------\n   1  net-misc/curl                \u003c 7.74.0                  \u003e= 7.74.0\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in cURL. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll cURL users should upgrade to the latest version:\n\n   # emerge --sync\n   # emerge --ask --oneshot --verbose \"\u003e=net-misc/curl-7.74.0\"\n\nReferences\n==========\n\n[ 1 ] CVE-2020-8231\n       https://nvd.nist.gov/vuln/detail/CVE-2020-8231\n[ 2 ] CVE-2020-8284\n       https://nvd.nist.gov/vuln/detail/CVE-2020-8284\n[ 3 ] CVE-2020-8285\n       https://nvd.nist.gov/vuln/detail/CVE-2020-8285\n[ 4 ] CVE-2020-8286\n       https://nvd.nist.gov/vuln/detail/CVE-2020-8286\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n  https://security.gentoo.org/glsa/202012-14\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2020 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2021-04-26-2 macOS Big Sur 11.3\n\nmacOS Big Sur 11.3 addresses the following issues. \nInformation about the security content is also available at\nhttps://support.apple.com/HT212325. \n\nAPFS\nAvailable for: macOS Big Sur\nImpact: A local attacker may be able to elevate their privileges\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2021-1853: Gary Nield of ECSC Group plc and Tim\nMichaud(@TimGMichaud) of Zoom Video Communications\n\nAppleMobileFileIntegrity\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An issue in code signature validation was addressed with\nimproved checks. \nCVE-2021-1849: Siguza\n\nApple Neural Engine\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2021-1867: Zuozhi Fan (@pattern_F_) and Wish Wu(\u5434\u6f4d\u6d60) of Ant Group\nTianqiong Security Lab\n\nArchive Utility\nAvailable for: macOS Big Sur\nImpact: A malicious application may bypass Gatekeeper checks\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2021-1810: an anonymous researcher\n\nAudio\nAvailable for: macOS Big Sur\nImpact: An application may be able to read restricted memory\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2021-1808: JunDong Xie of Ant Security Light-Year Lab\n\nCFNetwork\nAvailable for: macOS Big Sur\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2021-1857: an anonymous researcher\n\nCoreAudio\nAvailable for: macOS Big Sur\nImpact: Processing a maliciously crafted audio file may disclose\nrestricted memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2021-1846: JunDong Xie of Ant Security Light-Year Lab\n\nCoreAudio\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to read restricted memory\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2021-1809: JunDong Xie of Ant Security Light-Year Lab\n\nCoreFoundation\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to leak sensitive user\ninformation\nDescription: A validation issue was addressed with improved logic. \nCVE-2021-30659: Thijs Alkemade of Computest\n\nCoreGraphics\nAvailable for: macOS Big Sur\nImpact: Opening a maliciously crafted file may lead to unexpected\napplication termination or arbitrary code execution\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2021-1847: Xuwei Liu of Purdue University\n\nCoreText\nAvailable for: macOS Big Sur\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2021-1811: Xingwei Lin of Ant Security Light-Year Lab\n\ncurl\nAvailable for: macOS Big Sur\nImpact: An attacker may provide a fraudulent OCSP response that would\nappear valid\nDescription: This issue was addressed with improved checks. \nCVE-2020-8286: an anonymous researcher\n\ncurl\nAvailable for: macOS Big Sur\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A buffer overflow was addressed with improved input\nvalidation. \nCVE-2020-8285: xnynx\n\nDiskArbitration\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to modify protected parts\nof the file system\nDescription: A permissions issue existed in DiskArbitration. This was\naddressed with additional ownership checks. \nCVE-2021-1784: Mikko Kentt\u00e4l\u00e4 (@Turmio_) of SensorFu, Csaba Fitzl\n(@theevilbit) of Offensive Security, and an anonymous researcher\n\nFaceTime\nAvailable for: macOS Big Sur\nImpact: Muting a CallKit call while ringing may not result in mute\nbeing enabled\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2021-1872: Siraj Zaneer of Facebook\n\nFontParser\nAvailable for: macOS Big Sur\nImpact: Processing a maliciously crafted font file may lead to\narbitrary code execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2021-1881: an anonymous researcher, Xingwei Lin of Ant Security\nLight-Year Lab, Mickey Jin of Trend Micro, and Hou JingYi\n(@hjy79425575) of Qihoo 360\n\nFoundation\nAvailable for: macOS Big Sur\nImpact: An application may be able to gain elevated privileges\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2021-1882: Gabe Kirkpatrick (@gabe_k)\n\nFoundation\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to gain root privileges\nDescription: A validation issue was addressed with improved logic. \nCVE-2021-1813: Cees Elzinga\n\nHeimdal\nAvailable for: macOS Big Sur\nImpact: Processing maliciously crafted server messages may lead to\nheap corruption\nDescription: This issue was addressed with improved checks. \nCVE-2021-1883: Gabe Kirkpatrick (@gabe_k)\n\nHeimdal\nAvailable for: macOS Big Sur\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A race condition was addressed with improved locking. \nCVE-2021-1884: Gabe Kirkpatrick (@gabe_k)\n\nImageIO\nAvailable for: macOS Big Sur\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: This issue was addressed with improved checks. \nCVE-2021-1880: Xingwei Lin of Ant Security Light-Year Lab\nCVE-2021-30653: Ye Zhang of Baidu Security\nCVE-2021-1814: Ye Zhang of Baidu Security, Mickey Jin \u0026 Qi Sun of\nTrend Micro, and  Xingwei Lin of Ant Security Light-Year Lab\nCVE-2021-1843: Ye Zhang of Baidu Security\n\nImageIO\nAvailable for: macOS Big Sur\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2021-1885: CFF of Topsec Alpha Team\n\nImageIO\nAvailable for: macOS Big Sur\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking. \nCVE-2021-1858: Mickey Jin of Trend Micro\n\nInstaller\nAvailable for: macOS Big Sur\nImpact: A malicious application may bypass Gatekeeper checks\nDescription: This issue was addressed with improved handling of file\nmetadata. \nCVE-2021-30658: Wojciech Regu\u0142a (@_r3ggi) of SecuRing\n\nIntel Graphics Driver\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking. \nCVE-2021-1841: Jack Dates of RET2 Systems, Inc. \nCVE-2021-1834: ABC Research s.r.o. working with Trend Micro Zero Day\nInitiative\n\nKernel\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to disclose kernel memory\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2021-1860: @0xalsr\n\nKernel\nAvailable for: macOS Big Sur\nImpact: A local attacker may be able to elevate their privileges\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2021-1840: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong\nSecurity Lab\n\nKernel\nAvailable for: macOS Big Sur\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2021-1851: @0xalsr\n\nKernel\nAvailable for: macOS Big Sur\nImpact: Copied files may not have the expected file permissions\nDescription: The issue was addressed with improved permissions logic. \nCVE-2021-1832: an anonymous researcher\n\nKernel\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to disclose kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2021-30660: Alex Plaskett\n\nlibxpc\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to gain root privileges\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2021-30652: James Hutchins\n\nlibxslt\nAvailable for: macOS Big Sur\nImpact: Processing a maliciously crafted file may lead to heap\ncorruption\nDescription: A double free issue was addressed with improved memory\nmanagement. \nCVE-2021-1875: Found by OSS-Fuzz\n\nLogin Window\nAvailable for: macOS Big Sur\nImpact: A malicious application with root privileges may be able to\naccess private information\nDescription: This issue was addressed with improved entitlements. \nCVE-2021-1824: Wojciech Regu\u0142a (@_r3ggi) of SecuRing\n\nNotes\nAvailable for: macOS Big Sur\nImpact: Locked Notes content may have been unexpectedly unlocked\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2021-1859: Syed Ali Shuja (@SyedAliShuja) of Colour King Pvt. Ltd\n\nNSRemoteView\nAvailable for: macOS Big Sur\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2021-1876: Matthew Denton of Google Chrome\n\nPreferences\nAvailable for: macOS Big Sur\nImpact: A local user may be able to modify protected parts of the\nfile system\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation. \nCVE-2021-1815: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020)\nof Tencent Security Xuanwu Lab (xlab.tencent.com)\nCVE-2021-1739: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020)\nof Tencent Security Xuanwu Lab (xlab.tencent.com)\nCVE-2021-1740: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020)\nof Tencent Security Xuanwu Lab (xlab.tencent.com)\n\nSafari\nAvailable for: macOS Big Sur\nImpact: A malicious website may be able to track users by setting\nstate in a cache\nDescription: An issue existed in determining cache occupancy. The\nissue was addressed through improved logic. \nCVE-2021-1861: Konstantinos Solomos of University of Illinois at\nChicago\n\nSafari\nAvailable for: macOS Big Sur\nImpact: A malicious website may be able to force unnecessary network\nconnections to fetch its favicon\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2021-1855: H\u00e5vard Mikkelsen Ottestad of HASMAC AS\n\nSampleAnalysis\nAvailable for: macOS Big Sur\nImpact: A local attacker may be able to elevate their privileges\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2021-1868: Tim Michaud of Zoom Communications\n\nsmbx\nAvailable for: macOS Big Sur\nImpact: An attacker in a privileged network position may be able to\nleak sensitive user information\nDescription: An integer overflow was addressed with improved input\nvalidation. \nCVE-2021-1878: Aleksandar Nikolic of Cisco Talos\n(talosintelligence.com)\n\nSystem Preferences\nAvailable for: macOS Big Sur\nImpact: A malicious application may bypass Gatekeeper checks\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2021-30657: an anonymous researcher\n\ntcpdump\nAvailable for: macOS Big Sur\nImpact: A remote attacker may be able to cause a denial of service\nDescription: This issue was addressed with improved checks. \nCVE-2020-8037: an anonymous researcher\n\nTime Machine\nAvailable for: macOS Big Sur\nImpact: A local attacker may be able to elevate their privileges\nDescription: The issue was addressed with improved permissions logic. \nCVE-2021-1839: Tim Michaud(@TimGMichaud) of Zoom Video Communications\nand Gary Nield of ECSC Group plc\n\nWebKit\nAvailable for: macOS Big Sur\nImpact: Processing maliciously crafted web content may lead to a\ncross site scripting attack\nDescription: An input validation issue was addressed with improved\ninput validation. \nCVE-2021-1825: Alex Camboe of Aon\u2019s Cyber Solutions\n\nWebKit\nAvailable for: macOS Big Sur\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed with improved\nstate management. \nCVE-2021-1817: an anonymous researcher\n\nWebKit\nAvailable for: macOS Big Sur\nImpact: Processing maliciously crafted web content may lead to\nuniversal cross site scripting\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2021-1826: an anonymous researcher\n\nWebKit\nAvailable for: macOS Big Sur\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2021-1820: an anonymous researcher\n\nWebKit Storage\nAvailable for: macOS Big Sur\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution. Apple is aware of a report that this issue\nmay have been actively exploited. \nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2021-30661: yangkang(@dnpushme) of 360 ATA\n\nWebRTC\nAvailable for: macOS Big Sur\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2020-7463: Megan2013678\n\nWi-Fi\nAvailable for: macOS Big Sur\nImpact: An application may be able to cause unexpected system\ntermination or write kernel memory\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2021-1828: Zuozhi Fan (@pattern_F_) of Ant Group Tianqiong\nSecurity Lab\n\nWi-Fi\nAvailable for: macOS Big Sur\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A type confusion issue was addressed with improved state\nhandling. \nCVE-2021-1829: Tielei Wang of Pangu Lab\n\nWi-Fi\nAvailable for: macOS Big Sur\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: The issue was addressed with improved permissions logic. \nCVE-2021-30655: Gary Nield of ECSC Group plc and Tim\nMichaud(@TimGMichaud) of Zoom Video Communications and Wojciech\nRegu\u0142a (@_r3ggi) of SecuRing\n\nWindows Server\nAvailable for: macOS Big Sur\nImpact: A malicious application may be able to unexpectedly leak a\nuser\u0027s credentials from secure text fields\nDescription: An API issue in Accessibility TCC permissions was\naddressed with improved state management. \nCVE-2021-1873: an anonymous researcher\n\nInstallation note:\n\nThis update may be obtained from the Mac App Store or\nApple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAmCHO0UACgkQZcsbuWJ6\njjA/XA/7BDDpbLo0btLbUrps6ELmcqFZhpvhuekw8Yd3jVeJihLcJGJpY38ZCcne\nsrCJHuXPzlk3ex0bVkKNRrB04xF0vCA4TEBsJ495754PAKWrxmlx0Ce8zg4h+ey/\ncMTaUgfB1sgOFO8kJCKJurCjhyQ3Xj5c5xa8/zxlKoAgI36PmhZsCoXC6KD+5mqn\nQCRF0kE/y0QSfsq13j4grLGMXLS4pkAJRMWvDiEliYDTw3pOul7ZDOwxLEyucVTv\nfE60H7ff7jfPbDcQ4yEgEbla40+YZYwl9Sv4zxIU2OBPva6HLbA+PXxk4F1QX7eA\nECrfycMSIbQKZ2phryENZCcrX5DN4M/VcGIHq4ujF2CXBJymSWV0O5k5K0GzZ0Ko\nT2Zr2LOOunvHGrYy0okholNYb0iMA09dvwuDdEGr+vhLZhq1BBbmThhNEnArl7mE\n/fx2bvaS3o8TxGuh7mbeFK9q5Tafxe5Qhwgz9pnAtqBC8z1NgQoetk9pKPNDIsNY\nt3/7Xcix+fs28YOjmxPTpntud0EGSjxXm4g0bDbsU922iV1Z3ncgOvd//IzPXniS\nv4IqR/gPbhg+c2CGoaezD91sE5onLuMmFCogkUyftGHnN0EueKMjI+3fmyG4l4d1\n0C3to6hKJNmTm56RgxwfVVOeVnsPF490s9LUYzO4ZUbaQHIuDfo=\n=9+Ju\n-----END PGP SIGNATURE-----\n\n\n. ==========================================================================\nUbuntu Security Notice USN-4665-2\nDecember 09, 2020\n\ncurl vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 14.04 ESM\n- Ubuntu 12.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in curl. \n\nSoftware Description:\n- curl: HTTP, HTTPS, and FTP client and client libraries\n\nDetails:\n\nUSN-4665-1 fixed several vulnerabilities in curl. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. \n\nOriginal advisory details:\n\n Varnavas Papaioannou discovered that curl incorrectly handled FTP PASV\n responses. An attacker could possibly use this issue to trick curl into\n connecting to an arbitrary IP address and be used to perform port scanner\n and other information gathering. (CVE-2020-8284)\n\n It was discovered that curl incorrectly handled FTP wildcard matchins. (CVE-2020-8285)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 14.04 ESM:\n  curl                            7.35.0-1ubuntu2.20+esm6\n  libcurl3                        7.35.0-1ubuntu2.20+esm6\n  libcurl3-gnutls                 7.35.0-1ubuntu2.20+esm6\n  libcurl3-nss                    7.35.0-1ubuntu2.20+esm6\n\nUbuntu 12.04 ESM:\n  curl                            7.22.0-3ubuntu4.29\n  libcurl3                        7.22.0-3ubuntu4.29\n  libcurl3-gnutls                 7.22.0-3ubuntu4.29\n  libcurl3-nss                    7.22.0-3ubuntu4.29\n\nIn general, a standard system update will make all the necessary changes",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-8285"
      },
      {
        "db": "VULHUB",
        "id": "VHN-186410"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8285"
      },
      {
        "db": "PACKETSTORM",
        "id": "163188"
      },
      {
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "db": "PACKETSTORM",
        "id": "162360"
      },
      {
        "db": "PACKETSTORM",
        "id": "160706"
      },
      {
        "db": "PACKETSTORM",
        "id": "162358"
      },
      {
        "db": "PACKETSTORM",
        "id": "160436"
      }
    ],
    "trust": 1.71
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-186410",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186410"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-8285",
        "trust": 2.5
      },
      {
        "db": "SIEMENS",
        "id": "SSA-389290",
        "trust": 1.7
      },
      {
        "db": "HACKERONE",
        "id": "1045844",
        "trust": 1.7
      },
      {
        "db": "PACKETSTORM",
        "id": "160706",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "162358",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "160436",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "163267",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "163496",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "160423",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "163276",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "162629",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2180",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.4343",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.0319",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.4364",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.1700",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.4534",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.1866",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.0634",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2471",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2657",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2365",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.1409.2",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.3141",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2711",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.4506",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.4058",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2023.3146",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.1841",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2228",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.1114",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021042704",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021071516",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021072050",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021051406",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021062315",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021092220",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021072112",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022031104",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021052026",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021062703",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "164192",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202012-756",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "163197",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "163193",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "162360",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "162362",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "163257",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-186410",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8285",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "163188",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186410"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8285"
      },
      {
        "db": "PACKETSTORM",
        "id": "163188"
      },
      {
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "db": "PACKETSTORM",
        "id": "162360"
      },
      {
        "db": "PACKETSTORM",
        "id": "160706"
      },
      {
        "db": "PACKETSTORM",
        "id": "162358"
      },
      {
        "db": "PACKETSTORM",
        "id": "160436"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8285"
      }
    ]
  },
  "id": "VAR-202012-1278",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186410"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2026-03-09T22:04:04.260000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Debian CVElist Bug Report Logs: curl: CVE-2020-8285: FTP wildcard stack overflow",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=f796e96235f578fd40fb69123bab0e97"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2020-8285 log"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2021-1693",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2021-1693"
      },
      {
        "title": "Debian Security Advisories: DSA-4881-1 curl -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=a9706a30f62799ecc4d45bdb53c244eb"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=4a9822530e6b610875f83ffc10e02aba"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=ec6577109e640dac19a6ddb978afe82d"
      },
      {
        "title": "myapp-container-jaxrs",
        "trust": 0.1,
        "url": "https://github.com/akiraabe/myapp-container-jaxrs "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-8285"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-674",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-787",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186410"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8285"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/202012-14"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
      },
      {
        "trust": 1.7,
        "url": "https://security.netapp.com/advisory/ntap-20210122-0007/"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/kb/ht212325"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/kb/ht212326"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/kb/ht212327"
      },
      {
        "trust": 1.7,
        "url": "https://www.debian.org/security/2021/dsa-4881"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2021/apr/51"
      },
      {
        "trust": 1.7,
        "url": "https://curl.se/docs/cve-2020-8285.html"
      },
      {
        "trust": 1.7,
        "url": "https://github.com/curl/curl/issues/6255"
      },
      {
        "trust": 1.7,
        "url": "https://hackerone.com/reports/1045844"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
      },
      {
        "trust": 1.7,
        "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html"
      },
      {
        "trust": 1.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8285"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/nzuvsqhn2eshmjxnq2z7t2eelbb5hjxg/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/daehe2s2qlo4ao4meeyl75nb7sah5psl/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.9,
        "url": "https://access.redhat.com/security/cve/cve-2020-8285"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/daehe2s2qlo4ao4meeyl75nb7sah5psl/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/nzuvsqhn2eshmjxnq2z7t2eelbb5hjxg/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3cissues.bookkeeper.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/164192/red-hat-security-advisory-2021-3556-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.1866"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.0634"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.1700"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2657"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/libcurl-denial-of-service-via-ftp-wildcard-34067"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2711"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.1841"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021042704"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.4343/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.0319/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2023.3146"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-curl-libcurl-vulnerabilites-impacting-aspera-high-speed-transfer-server-aspera-high-speed-transfer-endpoint-aspera-desktop-client-4-0-and-earlier-cve-2020-8284-cve-2020-8286-c/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.1409.2"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.1114"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2365"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-curl-affect-powersc-cve-2020-8284-cve-2020-8285-and-cve-2020-8286/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2180"
      },
      {
        "trust": 0.6,
        "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/162629/red-hat-security-advisory-2021-1610-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/163276/red-hat-security-advisory-2021-2543-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/162358/apple-security-advisory-2021-04-26-2.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021052026"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/160706/gentoo-linux-security-advisory-202012-14.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021072050"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/163496/red-hat-security-advisory-2021-2705-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2228"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021062703"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021092220"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.4534/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.4364/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021072112"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/160436/ubuntu-security-notice-usn-4665-2.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/6520474"
      },
      {
        "trust": 0.6,
        "url": "https://support.apple.com/en-us/ht212327"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.4506/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/163267/red-hat-security-advisory-2021-2532-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2471"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021071516"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021062315"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.4058"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/160423/ubuntu-security-notice-usn-4665-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-qradar-analyst-workflow-add-on-to-ibm-qradar-siem-is-vulnerable-to-using-components-with-known-vulnerabilities/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021051406"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.3141"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022031104"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8286"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8284"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-8286"
      },
      {
        "trust": 0.3,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-8284"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-22901"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-22901"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-22890"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-22876"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-22890"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8169"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-31618"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-31618"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-8169"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-22876"
      },
      {
        "trust": 0.2,
        "url": "https://support.apple.com/kb/ht201222"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1813"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1840"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1739"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1828"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1809"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8037"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1784"
      },
      {
        "trust": 0.2,
        "url": "https://support.apple.com/downloads/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1843"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1810"
      },
      {
        "trust": 0.2,
        "url": "https://www.apple.com/support/security/pgp/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1811"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1839"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1824"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1834"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1740"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1808"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25039"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-28196"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-15358"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15358"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21639"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12364"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-28165"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-14502"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-28092"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13434"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25037"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13776"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25037"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-3842"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13776"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-24977"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-12363"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-8231"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-27219"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10878"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-29362"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-24330"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-28935"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-28163"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13434"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-14502"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25034"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25035"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-10228"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-9169"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-14866"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-26116"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25038"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14866"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-26137"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25013"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21309"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25040"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21640"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-29361"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-28918"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-24330"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3543"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25042"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3501"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25042"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-12362"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25648"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25038"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25032"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25041"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-8648"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25036"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25032"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-27619"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-27170"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-25215"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3177"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9169"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-24331"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25692"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3326"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25036"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25013"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25035"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-2708"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-23336"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-2433"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-8927"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10543"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3347"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12362"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12363"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-29363"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-24332"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3114"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-28362"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-3842"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10543"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25039"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25040"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-12364"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2708"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-10228"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10878"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25041"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2461"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25034"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-27618"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.apachehttp\u0026downloadtype=securitypatches\u0026version=2.4.37"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.openssl\u0026downloadtype=securitypatches\u0026version=1.1.1g"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2471"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2472"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1860"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1857"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1876"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1851"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/ht212326."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1875"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1847"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27942"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-3838"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1797"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1873"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1868"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8231"
      },
      {
        "trust": 0.1,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1814"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1820"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1815"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1817"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-7463"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1846"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1841"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1825"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1826"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1832"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/ht212325."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-1829"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4665-1"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4665-2"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186410"
      },
      {
        "db": "PACKETSTORM",
        "id": "163188"
      },
      {
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "db": "PACKETSTORM",
        "id": "162360"
      },
      {
        "db": "PACKETSTORM",
        "id": "160706"
      },
      {
        "db": "PACKETSTORM",
        "id": "162358"
      },
      {
        "db": "PACKETSTORM",
        "id": "160436"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8285"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-186410"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8285"
      },
      {
        "db": "PACKETSTORM",
        "id": "163188"
      },
      {
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "db": "PACKETSTORM",
        "id": "162360"
      },
      {
        "db": "PACKETSTORM",
        "id": "160706"
      },
      {
        "db": "PACKETSTORM",
        "id": "162358"
      },
      {
        "db": "PACKETSTORM",
        "id": "160436"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8285"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-12-14T00:00:00",
        "db": "VULHUB",
        "id": "VHN-186410"
      },
      {
        "date": "2020-12-14T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-8285"
      },
      {
        "date": "2021-06-17T17:53:22",
        "db": "PACKETSTORM",
        "id": "163188"
      },
      {
        "date": "2021-06-17T18:01:23",
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "date": "2021-06-17T18:09:26",
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "date": "2021-04-28T14:58:36",
        "db": "PACKETSTORM",
        "id": "162360"
      },
      {
        "date": "2020-12-24T17:16:22",
        "db": "PACKETSTORM",
        "id": "160706"
      },
      {
        "date": "2021-04-28T14:55:56",
        "db": "PACKETSTORM",
        "id": "162358"
      },
      {
        "date": "2020-12-10T16:02:10",
        "db": "PACKETSTORM",
        "id": "160436"
      },
      {
        "date": "2020-12-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      },
      {
        "date": "2020-12-14T20:15:13.983000",
        "db": "NVD",
        "id": "CVE-2020-8285"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-05-13T00:00:00",
        "db": "VULHUB",
        "id": "VHN-186410"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-8285"
      },
      {
        "date": "2023-06-05T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      },
      {
        "date": "2024-11-21T05:38:39.410000",
        "db": "NVD",
        "id": "CVE-2020-8285"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "HAXX libcurl Security hole",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202012-756"
      }
    ],
    "trust": 0.6
  }
}

VAR-201303-0327

Vulnerability from variot - Updated: 2026-03-09 21:42

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext. The RC4 algorithm, as used in SSL/TLS, is prone to a security weakness that may allow attackers to recover plain-text. Successfully exploiting this issue in conjunction with other latent vulnerabilities may allow attackers to gain access to sensitive information that may aid in further attacks. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. - HPE iMC PLAT - Please refer to the RESOLUTION below for a list of impacted products. All product versions are impacted prior to the fixed version listed.

iMC PLAT - Version: IMC PLAT 7.2, E0403P10
- JD125A HP IMC Std S/W Platform w/100-node
- JD126A HP IMC Ent S/W Platform w/100-node
- JD808A HP IMC Ent Platform w/100-node License
- JD814A HP A-IMC Enterprise Edition Software DVD Media
- JD815A HP IMC Std Platform w/100-node License
- JD816A HP A-IMC Standard Edition Software DVD Media
- JF288AAE HP Network Director to Intelligent Management Center Upgrade E-LTU
- JF289AAE HP Enterprise Management System to Intelligent Management Center Upgrade E-LTU
- JF377A HP IMC Std S/W Platform w/100-node Lic
- JF377AAE HP IMC Std S/W Pltfrm w/100-node E-LTU
- JF378A HP IMC Ent S/W Platform w/200-node Lic
- JF378AAE HP IMC Ent S/W Pltfrm w/200-node E-LTU
- JG546AAE HP IMC Basic SW Platform w/50-node E-LTU
- JG548AAE HP PCM+ to IMC Bsc Upgr w/50-node E-LTU
- JG549AAE HP PCM+ to IMC Std Upgr w/200-node E-LTU
- JG747AAE HP IMC Std SW Plat w/ 50 Nodes E-LTU
- JG748AAE HP IMC Ent SW Plat w/ 50 Nodes E-LTU
- JG550AAE HPE PCM+ Mobility Manager to IMC Basic WLAN Platform Upgrade 50-node and 150-AP E-LTU
- JG590AAE HPE IMC Basic WLAN Manager Software Platform 50 Access Point E-LTU
- JG660AAE HP IMC Smart Connect with Wireless Manager Virtual Appliance Edition E-LTU
- JG766AAE HP IMC Smart Connect Virtual Appliance Edition E-LTU
- JG767AAE HP IMC Smart Connect with Wireless Manager Virtual Appliance Edition E-LTU
- JG768AAE HPE PCM+ to IMC Standard Software Platform Upgrade with 200-node E-LTU

Note: Please contact HPE Technical Support if any assistance is needed acquiring the software updates.

HISTORY Version:1 (rev.1) - 26 September 2016 Initial release

Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05336888

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c05336888 Version: 1

HPSBHF03673 rev.1 - HPE Comware 5 and Comware 7 Network Products using SSL/TLS, Multiple Remote Vulnerabilities

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2016-11-18 Last Updated: 2016-11-18

Potential Security Impact: Remote: Multiple Vulnerabilities

Source: Hewlett Packard Enterprise, Product Security Response Team

VULNERABILITY SUMMARY Security vulnerabilities in MD5 message digest algorithm and RC4 ciphersuite could potentially impact HPE Comware 5 and Comware 7 network products using SSL/TLS. These vulnerabilities could be exploited remotely to conduct spoofing attacks and plaintext recovery attacks resulting in disclosure of information.

References:

CVE-2004-2761 - MD5 Hash Collision Vulnerability
CVE-2013-2566 - SSL/TLS RC4 algorithm vulnerability
CVE-2015-2808 - SSL/TLS RC4 stream vulnerability known as "Bar Mitzvah"

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

Comware 5 (CW5) Products All versions
Comware 7 (CW7) Products All versions

BACKGROUND

CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector

CVE-2004-2761
  5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVE-2013-2566
  5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVE-2015-2808
  5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Information on CVSS is documented in
HPE Customer Notice HPSN-2008-002 here:

https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499

RESOLUTION

HPE has released the following mitigation information to resolve the vulnerabilities in HPE Comware 5 and Comware 7 network products.

Note: Please contact HPE Technical Support for any assistance configuring the recommended settings.

Mitigation for the hash collision vulnerability in the MD5 Algorithm:

For Comware V7, this issue only exists when the key-type is RSA and the public key length less than 1024 bits. Since the default length of the RSA key is 1024 bits, the length should only have to be set manually if necessary.

Example command to set the RSA key length to 1024 bits:
```
  public-key rsa general name xxx length 1024
```
For Comware V5, this issue only exists when the key-type is RSA. HPE recommends using DSA and ECDSA keys and not an RSA key.

Mitigation for the RC4 vulnerabilities:

HPE recommends disabling RC2 and RC4 ciphers.

For Comware V7, remove the RC2/RC4 ciphers:
- exp_rsa_rc2_md5
- exp_rsa_rc4_md5
- rsa_rc4_128_md5
- rsa_rc4_128_sha
  
  Example using the ssl server-policy anamea ciphersuite command to omit the RC2/RC4 ciphers:
```
ssl server-policy anamea ciphersuite { dhe_rsa_aes_128_cbc_sha |
```
  dhe_rsa_aes_256_cbc_sha | exp_rsa_des_cbc_sha | rsa_3des_ede_cbc_sha | rsa_aes_128_cbc_sha | rsa_aes_256_cbc_sha | rsa_des_cbc_sha }
  
  Example using the ssl client-policy anamea prefer-cipher command to omit the RC2/RC4 ciphers:
```
ssl client-policy anamea prefer-cipher { dhe_rsa_aes_128_cbc_sha
```
  | dhe_rsa_aes_256_cbc_sha | exp_rsa_des_cbc_sha | rsa_3des_ede_cbc_sha | rsa_aes_128_cbc_sha | rsa_aes_256_cbc_sha | rsa_des_cbc_sha }
For Comware V5, remove the following RC4 ciphers:
- rsa_rc4_128_md5
- rsa_rc4_128_sha
  
  Example using the ssl server-policy anamea ciphersuite command to omit the RC4 ciphers:
```
ssl server-policy anamea ciphersuite { rsa_3des_ede_cbc_sha |
```
  rsa_aes_128_cbc_sha | rsa_aes_256_cbc_sha| rsa_des_cbc_sha }
  
  Example using the ssl client-policy anamea prefer-cipher command to omit the RC4 ciphers:
```
ssl client-policy anamea prefer-cipher { rsa_3des_ede_cbc_sha |
```
  rsa_aes_128_cbc_sha |rsa_aes_256_cbc_sha | rsa_des_cbc_sha }

COMWARE 5 Products

HSR6602 (Comware 5) - Version: See Mitigation
- HP Network Products
- JC176A HP 6602 Router Chassis
- JG353A HP HSR6602-G Router
- JG354A HP HSR6602-XG Router
- JG355A HP 6600 MCP-X1 Router Main Processing Unit
- JG356A HP 6600 MCP-X2 Router Main Processing Unit
- JG776A HP HSR6602-G TAA-compliant Router
- JG777A HP HSR6602-XG TAA-compliant Router
- JG778A HP 6600 MCP-X2 Router TAA-compliant Main Processing Unit
HSR6800 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG361A HP HSR6802 Router Chassis
- JG361B HP HSR6802 Router Chassis
- JG362A HP HSR6804 Router Chassis
- JG362B HP HSR6804 Router Chassis
- JG363A HP HSR6808 Router Chassis
- JG363B HP HSR6808 Router Chassis
- JG364A HP HSR6800 RSE-X2 Router Main Processing Unit
- JG779A HP HSR6800 RSE-X2 Router TAA-compliant Main Processing Unit
MSR20 (Comware 5) - Version: See Mitigation
- HP Network Products
- JD432A HP A-MSR20-21 Router
- JD662A HP MSR20-20 Router
- JD663A HP A-MSR20-21 Router
- JD663B HP MSR20-21 Router
- JD664A HP MSR20-40 Router
- JF228A HP MSR20-40 Router
- JF283A HP MSR20-20 Router
MSR20-1X (Comware 5) - Version: See Mitigation
- HP Network Products
- JD431A HP MSR20-10 Router
- JD667A HP MSR20-15 IW Multi-Service Router
- JD668A HP MSR20-13 Multi-Service Router
- JD669A HP MSR20-13 W Multi-Service Router
- JD670A HP MSR20-15 A Multi-Service Router
- JD671A HP MSR20-15 AW Multi-Service Router
- JD672A HP MSR20-15 I Multi-Service Router
- JD673A HP MSR20-11 Multi-Service Router
- JD674A HP MSR20-12 Multi-Service Router
- JD675A HP MSR20-12 W Multi-Service Router
- JD676A HP MSR20-12 T1 Multi-Service Router
- JF236A HP MSR20-15-I Router
- JF237A HP MSR20-15-A Router
- JF238A HP MSR20-15-I-W Router
- JF239A HP MSR20-11 Router
- JF240A HP MSR20-13 Router
- JF241A HP MSR20-12 Router
- JF806A HP MSR20-12-T Router
- JF807A HP MSR20-12-W Router
- JF808A HP MSR20-13-W Router
- JF809A HP MSR20-15-A-W Router
- JF817A HP MSR20-15 Router
- JG209A HP MSR20-12-T-W Router (NA)
- JG210A HP MSR20-13-W Router (NA)
MSR 30 (Comware 5) - Version: See Mitigation
- HP Network Products
- JD654A HP MSR30-60 POE Multi-Service Router
- JD657A HP MSR30-40 Multi-Service Router
- JD658A HP MSR30-60 Multi-Service Router
- JD660A HP MSR30-20 POE Multi-Service Router
- JD661A HP MSR30-40 POE Multi-Service Router
- JD666A HP MSR30-20 Multi-Service Router
- JF229A HP MSR30-40 Router
- JF230A HP MSR30-60 Router
- JF232A HP RTMSR3040-AC-OVSAS-H3
- JF235A HP MSR30-20 DC Router
- JF284A HP MSR30-20 Router
- JF287A HP MSR30-40 DC Router
- JF801A HP MSR30-60 DC Router
- JF802A HP MSR30-20 PoE Router
- JF803A HP MSR30-40 PoE Router
- JF804A HP MSR30-60 PoE Router
- JG728A HP MSR30-20 TAA-compliant DC Router
- JG729A HP MSR30-20 TAA-compliant Router
MSR 30-16 (Comware 5) - Version: See Mitigation
- HP Network Products
- JD659A HP MSR30-16 POE Multi-Service Router
- JD665A HP MSR30-16 Multi-Service Router
- JF233A HP MSR30-16 Router
- JF234A HP MSR30-16 PoE Router
MSR 30-1X (Comware 5) - Version: See Mitigation
- HP Network Products
- JF800A HP MSR30-11 Router
- JF816A HP MSR30-10 2 FE /2 SIC /1 MIM MS Rtr
- JG182A HP MSR30-11E Router
- JG183A HP MSR30-11F Router
- JG184A HP MSR30-10 DC Router
MSR 50 (Comware 5) - Version: See Mitigation
- HP Network Products
- JD433A HP MSR50-40 Router
- JD653A HP MSR50 Processor Module
- JD655A HP MSR50-40 Multi-Service Router
- JD656A HP MSR50-60 Multi-Service Router
- JF231A HP MSR50-60 Router
- JF285A HP MSR50-40 DC Router
- JF640A HP MSR50-60 Rtr Chassis w DC PwrSupply
MSR 50-G2 (Comware 5) - Version: See Mitigation
- HP Network Products
- JD429A HP MSR50 G2 Processor Module
- JD429B HP MSR50 G2 Processor Module
MSR 9XX (Comware 5) - Version: See Mitigation
- HP Network Products
- JF812A HP MSR900 Router
- JF813A HP MSR920 Router
- JF814A HP MSR900-W Router
- JF815A HP MSR920 2FEWAN/8FELAN/.11 b/g Rtr
- JG207A HP MSR900-W Router (NA)
- JG208A HP MSR920-W Router (NA)
MSR 93X (Comware 5) - Version: See Mitigation
- HP Network Products
- JG511A HP MSR930 Router
- JG511B HP MSR930 Router
- JG512A HP MSR930 Wireless Router
- JG513A HP MSR930 3G Router
- JG513B HP MSR930 3G Router
- JG514A HP MSR931 Router
- JG514B HP MSR931 Router
- JG515A HP MSR931 3G Router
- JG516A HP MSR933 Router
- JG517A HP MSR933 3G Router
- JG518A HP MSR935 Router
- JG518B HP MSR935 Router
- JG519A HP MSR935 Wireless Router
- JG520A HP MSR935 3G Router
- JG531A HP MSR931 Dual 3G Router
- JG531B HP MSR931 Dual 3G Router
- JG596A HP MSR930 4G LTE/3G CDMA Router
- JG597A HP MSR936 Wireless Router
- JG665A HP MSR930 4G LTE/3G WCDMA Global Router
- JG704A HP MSR930 4G LTE/3G WCDMA ATT Router
- JH009A HP MSR931 Serial (TI) Router
- JH010A HP MSR933 G.SHDSL (TI) Router
- JH011A HP MSR935 ADSL2+ (TI) Router
- JH012A HP MSR930 Wireless 802.11n (NA) Router
- JH012B HP MSR930 Wireless 802.11n (NA) Router
- JH013A HP MSR935 Wireless 802.11n (NA) Router
MSR1000 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG732A HP MSR1003-8 AC Router
12500 (Comware 5) - Version: See Mitigation
- HP Network Products
- JC072B HP 12500 Main Processing Unit
- JC085A HP A12518 Switch Chassis
- JC086A HP A12508 Switch Chassis
- JC652A HP 12508 DC Switch Chassis
- JC653A HP 12518 DC Switch Chassis
- JC654A HP 12504 AC Switch Chassis
- JC655A HP 12504 DC Switch Chassis
- JC808A HP 12500 TAA Main Processing Unit
- JF430A HP A12518 Switch Chassis
- JF430B HP 12518 Switch Chassis
- JF430C HP 12518 AC Switch Chassis
- JF431A HP A12508 Switch Chassis
- JF431B HP 12508 Switch Chassis
- JF431C HP 12508 AC Switch Chassis
9500E (Comware 5) - Version: See Mitigation
- HP Network Products
- JC124A HP A9508 Switch Chassis
- JC124B HP 9505 Switch Chassis
- JC125A HP A9512 Switch Chassis
- JC125B HP 9512 Switch Chassis
- JC474A HP A9508-V Switch Chassis
- JC474B HP 9508-V Switch Chassis
10500 (Comware 5) - Version: See Mitigation
- HP Network Products
- JC611A HP 10508-V Switch Chassis
- JC612A HP 10508 Switch Chassis
- JC613A HP 10504 Switch Chassis
- JC614A HP 10500 Main Processing Unit
- JC748A HP 10512 Switch Chassis
- JG375A HP 10500 TAA-compliant Main Processing Unit
- JG820A HP 10504 TAA-compliant Switch Chassis
- JG821A HP 10508 TAA-compliant Switch Chassis
- JG822A HP 10508-V TAA-compliant Switch Chassis
- JG823A HP 10512 TAA-compliant Switch Chassis
7500 (Comware 5) - Version: See Mitigation
- HP Network Products
- JC666A HP 7503-S 144Gbps Fabric/MPU with PoE Upgradable 20-port Gig-T/4-port GbE Combo
- JC697A HP 7502 TAA-compliant Main Processing Unit
- JC698A HP 7503-S 144Gbps TAA Fabric / MPU with 16 GbE SFP Ports and 8 GbE Combo Ports
- JC699A HP 7500 384Gbps TAA-compliant Fabric / MPU with 2 10GbE XFP Ports
- JC700A HP 7500 384Gbps TAA-compliant Fabric / Main Processing Unit
- JC701A HP 7500 768Gbps TAA-compliant Fabric / Main Processing Unit
- JD193A HP 7500 384Gbps Fabric Module with 2 XFP Ports
- JD193B HP 7500 384Gbps Fabric Module with 2 XFP Ports
- JD194A HP 7500 384Gbps Fabric Module
- JD194B HP 7500 384Gbps Fabric Module
- JD195A HP 7500 384Gbps Advanced Fabric Module
- JD196A HP 7502 Fabric Module
- JD220A HP 7500 768Gbps Fabric Module
- JD224A HP 7500 384Gbps Fabric Module with 12 SFP Ports
- JD238A HP 7510 Switch Chassis
- JD238B HP 7510 Switch Chassis
- JD239A HP 7506 Switch Chassis
- JD239B HP 7506 Switch Chassis
- JD240A HP 7503 Switch Chassis
- JD240B HP 7503 Switch Chassis
- JD241A HP 7506-V Switch Chassis
- JD241B HP 7506-V Switch Chassis
- JD242A HP 7502 Switch Chassis
- JD242B HP 7502 Switch Chassis
- JD243A HP 7503-S Switch Chassis with 1 Fabric Slot
- JD243B HP 7503-S Switch Chassis with 1 Fabric Slot
- JE164A HP E7902 Switch Chassis
- JE165A HP E7903 Switch Chassis
- JE166A HP E7903 1 Fabric Slot Switch Chassis
- JE167A HP E7906 Switch Chassis
- JE168A HP E7906 Vertical Switch Chassis
- JE169A HP E7910 Switch Chassis
6125G/XG Blade Switch - Version: See Mitigation
- HP Network Products
- 737220-B21 HP 6125G Blade Switch with TAA
- 737226-B21 HP 6125G/XG Blade Switch with TAA
- 658250-B21 HP 6125G/XG Blade Switch Opt Kit
- 658247-B21 HP 6125G Blade Switch Opt Kit
5830 (Comware 5) - Version: See Mitigation
- HP Network Products
- JC691A HP 5830AF-48G Switch with 1 Interface Slot
- JC694A HP 5830AF-96G Switch
- JG316A HP 5830AF-48G TAA-compliant Switch w/1 Interface Slot
- JG374A HP 5830AF-96G TAA-compliant Switch
5800 (Comware 5) - Version: See Mitigation
- HP Network Products
- JC099A HP 5800-24G-PoE Switch
- JC099B HP 5800-24G-PoE+ Switch
- JC100A HP 5800-24G Switch
- JC100B HP 5800-24G Switch
- JC101A HP 5800-48G Switch with 2 Slots
- JC101B HP 5800-48G-PoE+ Switch with 2 Interface Slots
- JC103A HP 5800-24G-SFP Switch
- JC103B HP 5800-24G-SFP Switch with 1 Interface Slot
- JC104A HP 5800-48G-PoE Switch
- JC104B HP 5800-48G-PoE+ Switch with 1 Interface Slot
- JC105A HP 5800-48G Switch
- JC105B HP 5800-48G Switch with 1 Interface Slot
- JG254A HP 5800-24G-PoE+ TAA-compliant Switch
- JG254B HP 5800-24G-PoE+ TAA-compliant Switch
- JG255A HP 5800-24G TAA-compliant Switch
- JG255B HP 5800-24G TAA-compliant Switch
- JG256A HP 5800-24G-SFP TAA-compliant Switch with 1 Interface Slot
- JG256B HP 5800-24G-SFP TAA-compliant Switch with 1 Interface Slot
- JG257A HP 5800-48G-PoE+ TAA-compliant Switch with 1 Interface Slot
- JG257B HP 5800-48G-PoE+ TAA-compliant Switch with 1 Interface Slot
- JG258A HP 5800-48G TAA-compliant Switch with 1 Interface Slot
- JG258B HP 5800-48G TAA-compliant Switch with 1 Interface Slot
- JG225A HP 5800AF-48G Switch
- JG225B HP 5800AF-48G Switch
- JG242A HP 5800-48G-PoE+ TAA-compliant Switch with 2 Interface Slots
- JG242B HP 5800-48G-PoE+ TAA-compliant Switch with 2 Interface
- JG243A HP 5820-24XG-SFP+ TAA-compliant Switch
- JG243B HP 5820-24XG-SFP+ TAA-compliant Switch
- JG259A HP 5820X-14XG-SFP+ TAA-compliant Switch with 2 Interface Slots & 1 OAA Slot
- JG259B HP 5820-14XG-SFP+ TAA-compliant Switch with 2 Interface Slots and 1 OAA Slot
- JC106A HP 5820-14XG-SFP+ Switch with 2 Slots
- JC106B HP 5820-14XG-SFP+ Switch with 2 Interface Slots & 1 OAA Slot
- JG219A HP 5820AF-24XG Switch
- JG219B HP 5820AF-24XG Switch
- JC102A HP 5820-24XG-SFP+ Switch
- JC102B HP 5820-24XG-SFP+ Switch
5500 HI (Comware 5) - Version: See Mitigation
- HP Network Products
- JG311A HP 5500-24G-4SFP HI Switch with 2 Interface Slots
- JG312A HP 5500-48G-4SFP HI Switch with 2 Interface Slots
- JG541A HP 5500-24G-PoE+-4SFP HI Switch with 2 Interface Slots
- JG542A HP 5500-48G-PoE+-4SFP HI Switch with 2 Interface Slots
- JG543A HP 5500-24G-SFP HI Switch with 2 Interface Slots
- JG679A HP 5500-24G-PoE+-4SFP HI TAA-compliant Switch with 2 Interface Slots
- JG680A HP 5500-48G-PoE+-4SFP HI TAA-compliant Switch with 2 Interface Slots
- JG681A HP 5500-24G-SFP HI TAA-compliant Switch with 2 Interface Slots
5500 EI (Comware 5) - Version: See Mitigation
- HP Network Products
- JD373A HP 5500-24G DC EI Switch
- JD374A HP 5500-24G-SFP EI Switch
- JD375A HP 5500-48G EI Switch
- JD376A HP 5500-48G-PoE EI Switch
- JD377A HP 5500-24G EI Switch
- JD378A HP 5500-24G-PoE EI Switch
- JD379A HP 5500-24G-SFP DC EI Switch
- JG240A HP 5500-48G-PoE+ EI Switch with 2 Interface Slots
- JG241A HP 5500-24G-PoE+ EI Switch with 2 Interface Slots
- JG249A HP 5500-24G-SFP EI TAA-compliant Switch with 2 Interface
- JG250A HP 5500-24G EI TAA-compliant Switch with 2 Interface Slots
- JG251A HP 5500-48G EI TAA-compliant Switch with 2 Interface Slots
- JG252A HP 5500-24G-PoE+ EI TAA-compliant Switch with 2 Interface Slots
- JG253A HP 5500-48G-PoE+ EI TAA-compliant Switch with 2 Interface Slots
4800G (Comware 5) - Version: See Mitigation
- HP Network Products
- JD007A HP 4800-24G Switch
- JD008A HP 4800-24G-PoE Switch
- JD009A HP 4800-24G-SFP Switch
- JD010A HP 4800-48G Switch
- JD011A HP 4800-48G-PoE Switch
5500SI (Comware 5) - Version: See Mitigation
- HP Network Products
- JD369A HP 5500-24G SI Switch
- JD370A HP 5500-48G SI Switch
- JD371A HP 5500-24G-PoE SI Switch
- JD372A HP 5500-48G-PoE SI Switch
- JG238A HP 5500-24G-PoE+ SI Switch with 2 Interface Slots
- JG239A HP 5500-48G-PoE+ SI Switch with 2 Interface Slots
4500G (Comware 5) - Version: See Mitigation
- HP Network Products
- JF428A HP 4510-48G Switch
- JF847A HP 4510-24G Switch
5120 EI (Comware 5) - Version: See Mitigation
- HP Network Products
- JE066A HP 5120-24G EI Switch
- JE067A HP 5120-48G EI Switch
- JE068A HP 5120-24G EI Switch with 2 Interface Slots
- JE069A HP 5120-48G EI Switch with 2 Interface Slots
- JE070A HP 5120-24G-PoE EI 2-slot Switch
- JE071A HP 5120-48G-PoE EI 2-slot Switch
- JG236A HP 5120-24G-PoE+ EI Switch with 2 Interface Slots
- JG237A HP 5120-48G-PoE+ EI Switch with 2 Interface Slots
- JG245A HP 5120-24G EI TAA-compliant Switch with 2 Interface Slots
- JG246A HP 5120-48G EI TAA-compliant Switch with 2 Interface Slots
- JG247A HP 5120-24G-PoE+ EI TAA-compliant Switch with 2 Slots
- JG248A HP 5120-48G-PoE+ EI TAA-compliant Switch with 2 Slots
4210G (Comware 5) - Version: See Mitigation
- HP Network Products
- JF844A HP 4210-24G Switch
- JF845A HP 4210-48G Switch
- JF846A HP 4210-24G-PoE Switch
5120 SI (Comware 5) - Version: See Mitigation
- HP Network Products
- JE072A HP 5120-48G SI Switch
- JE072B HPE 5120 48G SI Switch
- JE073A HP 5120-16G SI Switch
- JE073B HPE 5120 16G SI Switch
- JE074A HP 5120-24G SI Switch
- JE074B HPE 5120 24G SI Switch
- JG091A HP 5120-24G-PoE+ (370W) SI Switch
- JG091B HPE 5120 24G PoE+ (370W) SI Switch
- JG092A HP 5120-24G-PoE+ (170W) SI Switch
- JG309B HPE 5120 8G PoE+ (180W) SI Switch
- JG310B HPE 5120 8G PoE+ (65W) SI Switch
3610 (Comware 5) - Version: See Mitigation
- HP Network Products
- JD335A HP 3610-48 Switch
- JD336A HP 3610-24-4G-SFP Switch
- JD337A HP 3610-24-2G-2G-SFP Switch
- JD338A HP 3610-24-SFP Switch
3600V2 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG299A HP 3600-24 v2 EI Switch
- JG299B HP 3600-24 v2 EI Switch
- JG300A HP 3600-48 v2 EI Switch
- JG300B HP 3600-48 v2 EI Switch
- JG301A HP 3600-24-PoE+ v2 EI Switch
- JG301B HP 3600-24-PoE+ v2 EI Switch
- JG301C HP 3600-24-PoE+ v2 EI Switch
- JG302A HP 3600-48-PoE+ v2 EI Switch
- JG302B HP 3600-48-PoE+ v2 EI Switch
- JG302C HP 3600-48-PoE+ v2 EI Switch
- JG303A HP 3600-24-SFP v2 EI Switch
- JG303B HP 3600-24-SFP v2 EI Switch
- JG304A HP 3600-24 v2 SI Switch
- JG304B HP 3600-24 v2 SI Switch
- JG305A HP 3600-48 v2 SI Switch
- JG305B HP 3600-48 v2 SI Switch
- JG306A HP 3600-24-PoE+ v2 SI Switch
- JG306B HP 3600-24-PoE+ v2 SI Switch
- JG306C HP 3600-24-PoE+ v2 SI Switch
- JG307A HP 3600-48-PoE+ v2 SI Switch
- JG307B HP 3600-48-PoE+ v2 SI Switch
- JG307C HP 3600-48-PoE+ v2 SI Switch
3100V2-48 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG315A HP 3100-48 v2 Switch
- JG315B HP 3100-48 v2 Switch
HP870 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG723A HP 870 Unified Wired-WLAN Appliance
- JG725A HP 870 Unified Wired-WLAN TAA-compliant Appliance
HP850 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG722A HP 850 Unified Wired-WLAN Appliance
- JG724A HP 850 Unified Wired-WLAN TAA-compliant Appliance
HP830 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG640A HP 830 24-Port PoE+ Unified Wired-WLAN Switch
- JG641A HP 830 8-port PoE+ Unified Wired-WLAN Switch
- JG646A HP 830 24-Port PoE+ Unified Wired-WLAN TAA-compliant Switch
- JG647A HP 830 8-Port PoE+ Unified Wired-WLAN TAA-compliant
HP6000 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG639A HP 10500/7500 20G Unified Wired-WLAN Module
- JG645A HP 10500/7500 20G Unified Wired-WLAN TAA-compliant Module
WX5004-EI (Comware 5) - Version: See Mitigation
- HP Network Products
- JD447B HP WX5002 Access Controller
- JD448A HP WX5004 Access Controller
- JD448B HP WX5004 Access Controller
- JD469A HP WX5004 Access Controller
SecBlade FW (Comware 5) - Version: See Mitigation
- HP Network Products
- JC635A HP 12500 VPN Firewall Module
- JD245A HP 9500 VPN Firewall Module
- JD249A HP 10500/7500 Advanced VPN Firewall Module
- JD250A HP 6600 Firewall Processing Router Module
- JD251A HP 8800 Firewall Processing Module
- JD255A HP 5820 VPN Firewall Module
F1000-E (Comware 5) - Version: See Mitigation
- HP Network Products
- JD272A HP F1000-E VPN Firewall Appliance
F1000-A-EI (Comware 5) - Version: See Mitigation
- HP Network Products
- JG214A HP F1000-A-EI VPN Firewall Appliance
F1000-S-EI (Comware 5) - Version: See Mitigation
- HP Network Products
- JG213A HP F1000-S-EI VPN Firewall Appliance
F5000-A (Comware 5) - Version: See Mitigation
- HP Network Products
- JD259A HP A5000-A5 VPN Firewall Chassis
- JG215A HP F5000 Firewall Main Processing Unit
- JG216A HP F5000 Firewall Standalone Chassis
U200S and CS (Comware 5) - Version: See Mitigation
- HP Network Products
- JD273A HP U200-S UTM Appliance
U200A and M (Comware 5) - Version: See Mitigation
- HP Network Products
- JD275A HP U200-A UTM Appliance
F5000-C/S (Comware 5) - Version: See Mitigation
- HP Network Products
- JG650A HP F5000-C VPN Firewall Appliance
- JG370A HP F5000-S VPN Firewall Appliance
SecBlade III (Comware 5) - Version: See Mitigation
- HP Network Products
- JG371A HP 12500 20Gbps VPN Firewall Module
- JG372A HP 10500/11900/7500 20Gbps VPN Firewall Module
6600 RSE RU (Comware 5 Low Encryption SW) - Version: See Mitigation
- HP Network Products
- JC177A HP 6608 Router
- JC177B HP 6608 Router Chassis
- JC178A HP 6604 Router Chassis
- JC178B HP 6604 Router Chassis
- JC496A HP 6616 Router Chassis
- JC566A HP 6600 RSE-X1 Router Main Processing Unit
- JG780A HP 6600 RSE-X1 TAA-compliant Main Processing Unit
6600 RPE RU (Comware 5 Low Encryption SW) - Version: See Mitigation
- HP Network Products
- JC165A HP 6600 RPE-X1 Router Module
- JG781A HP 6600 RPE-X1 TAA-compliant Main Processing Unit
6602 RU (Comware 5 Low Encryption SW) - Version: See Mitigation
- HP Network Products
- JC176A HP 6602 Router Chassis
HSR6602 RU (Comware 5 Low Encryption SW) - Version: See Mitigation
- HP Network Products
- JC177A HP 6608 Router
- JC177B HP 6608 Router Chassis
- JC178A HP 6604 Router Chassis
- JC178B HP 6604 Router Chassis
- JC496A HP 6616 Router Chassis
- JG353A HP HSR6602-G Router
- JG354A HP HSR6602-XG Router
- JG355A HP 6600 MCP-X1 Router Main Processing Unit
- JG356A HP 6600 MCP-X2 Router Main Processing Unit
- JG776A HP HSR6602-G TAA-compliant Router
- JG777A HP HSR6602-XG TAA-compliant Router
- JG778A HP 6600 MCP-X2 Router TAA-compliant Main Processing Unit
HSR6800 RU (Comware 5 Low Encryption SW) - Version: See Mitigation
- HP Network Products
- JG361A HP HSR6802 Router Chassis
- JG361B HP HSR6802 Router Chassis
- JG362A HP HSR6804 Router Chassis
- JG362B HP HSR6804 Router Chassis
- JG363A HP HSR6808 Router Chassis
- JG363B HP HSR6808 Router Chassis
- JG364A HP HSR6800 RSE-X2 Router Main Processing Unit
- JG779A HP HSR6800 RSE-X2 Router TAA-compliant Main Processing Unit
SMB1910 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG540A HP 1910-48 Switch
- JG539A HP 1910-24-PoE+ Switch
- JG538A HP 1910-24 Switch
- JG537A HP 1910-8 -PoE+ Switch
- JG536A HP 1910-8 Switch
SMB1920 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG928A HP 1920-48G-PoE+ (370W) Switch
- JG927A HP 1920-48G Switch
- JG926A HP 1920-24G-PoE+ (370W) Switch
- JG925A HP 1920-24G-PoE+ (180W) Switch
- JG924A HP 1920-24G Switch
- JG923A HP 1920-16G Switch
- JG922A HP 1920-8G-PoE+ (180W) Switch
- JG921A HP 1920-8G-PoE+ (65W) Switch
- JG920A HP 1920-8G Switch
V1910 (Comware 5) - Version: See Mitigation
- HP Network Products
- JE005A HP 1910-16G Switch
- JE006A HP 1910-24G Switch
- JE007A HP 1910-24G-PoE (365W) Switch
- JE008A HP 1910-24G-PoE(170W) Switch
- JE009A HP 1910-48G Switch
- JG348A HP 1910-8G Switch
- JG349A HP 1910-8G-PoE+ (65W) Switch
- JG350A HP 1910-8G-PoE+ (180W) Switch
SMB 1620 (Comware 5) - Version: See Mitigation
- HP Network Products
- JG914A HP 1620-48G Switch
- JG913A HP 1620-24G Switch
- JG912A HP 1620-8G Switch

COMWARE 7 Products

12500 (Comware 7) - Version: See Mitigation
- HP Network Products
- JC072B HP 12500 Main Processing Unit
- JC085A HP A12518 Switch Chassis
- JC086A HP A12508 Switch Chassis
- JC652A HP 12508 DC Switch Chassis
- JC653A HP 12518 DC Switch Chassis
- JC654A HP 12504 AC Switch Chassis
- JC655A HP 12504 DC Switch Chassis
- JF430A HP A12518 Switch Chassis
- JF430B HP 12518 Switch Chassis
- JF430C HP 12518 AC Switch Chassis
- JF431A HP A12508 Switch Chassis
- JF431B HP 12508 Switch Chassis
- JF431C HP 12508 AC Switch Chassis
- JG497A HP 12500 MPU w/Comware V7 OS
- JG782A HP FF 12508E AC Switch Chassis
- JG783A HP FF 12508E DC Switch Chassis
- JG784A HP FF 12518E AC Switch Chassis
- JG785A HP FF 12518E DC Switch Chassis
- JG802A HP FF 12500E MPU
10500 (Comware 7) - Version: See Mitigation
- HP Network Products
- JC611A HP 10508-V Switch Chassis
- JC612A HP 10508 Switch Chassis
- JC613A HP 10504 Switch Chassis
- JC748A HP 10512 Switch Chassis
- JG608A HP FlexFabric 11908-V Switch Chassis
- JG609A HP FlexFabric 11900 Main Processing Unit
- JG820A HP 10504 TAA Switch Chassis
- JG821A HP 10508 TAA Switch Chassis
- JG822A HP 10508-V TAA Switch Chassis
- JG823A HP 10512 TAA Switch Chassis
- JG496A HP 10500 Type A MPU w/Comware v7 OS
- JH198A HP 10500 Type D Main Processing Unit with Comware v7 Operating System
- JH206A HP 10500 Type D TAA-compliant with Comware v7 Operating System Main Processing Unit
12900 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG619A HP FlexFabric 12910 Switch AC Chassis
- JG621A HP FlexFabric 12910 Main Processing Unit
- JG632A HP FlexFabric 12916 Switch AC Chassis
- JG634A HP FlexFabric 12916 Main Processing Unit
- JH104A HP FlexFabric 12900E Main Processing Unit
- JH114A HP FlexFabric 12910 TAA-compliant Main Processing Unit
- JH263A HP FlexFabric 12904E Main Processing Unit
- JH255A HP FlexFabric 12908E Switch Chassis
- JH262A HP FlexFabric 12904E Switch Chassis
- JH113A HP FlexFabric 12910 TAA-compliant Switch AC Chassis
- JH103A HP FlexFabric 12916E Switch Chassis
5900 (Comware 7) - Version: See Mitigation
- HP Network Products
- JC772A HP 5900AF-48XG-4QSFP+ Switch
- JG296A HP 5920AF-24XG Switch
- JG336A HP 5900AF-48XGT-4QSFP+ Switch
- JG510A HP 5900AF-48G-4XG-2QSFP+ Switch
- JG554A HP 5900AF-48XG-4QSFP+ TAA Switch
- JG555A HP 5920AF-24XG TAA Switch
- JG838A HP FF 5900CP-48XG-4QSFP+ Switch
- JH036A HP FlexFabric 5900CP 48XG 4QSFP+ TAA-Compliant
- JH037A HP 5900AF 48XGT 4QSFP+ TAA-Compliant Switch
- JH038A HP 5900AF 48G 4XG 2QSFP+ TAA-Compliant
MSR1000 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG875A HP MSR1002-4 AC Router
- JH060A HP MSR1003-8S AC Router
MSR2000 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG411A HP MSR2003 AC Router
- JG734A HP MSR2004-24 AC Router
- JG735A HP MSR2004-48 Router
- JG866A HP MSR2003 TAA-compliant AC Router
MSR3000 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG404A HP MSR3064 Router
- JG405A HP MSR3044 Router
- JG406A HP MSR3024 AC Router
- JG407A HP MSR3024 DC Router
- JG408A HP MSR3024 PoE Router
- JG409A HP MSR3012 AC Router
- JG410A HP MSR3012 DC Router
- JG861A HP MSR3024 TAA-compliant AC Router
MSR4000 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG402A HP MSR4080 Router Chassis
- JG403A HP MSR4060 Router Chassis
- JG412A HP MSR4000 MPU-100 Main Processing Unit
- JG869A HP MSR4000 TAA-compliant MPU-100 Main Processing Unit
VSR (Comware 7) - Version: See Mitigation
- HP Network Products
- JG810AAE HP VSR1001 Virtual Services Router 60 Day Evaluation Software
- JG811AAE HP VSR1001 Comware 7 Virtual Services Router
- JG812AAE HP VSR1004 Comware 7 Virtual Services Router
- JG813AAE HP VSR1008 Comware 7 Virtual Services Router
7900 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG682A HP FlexFabric 7904 Switch Chassis
- JG841A HP FlexFabric 7910 Switch Chassis
- JG842A HP FlexFabric 7910 7.2Tbps Fabric / Main Processing Unit
- JH001A HP FlexFabric 7910 2.4Tbps Fabric / Main Processing Unit
- JH122A HP FlexFabric 7904 TAA-compliant Switch Chassis
- JH123A HP FlexFabric 7910 TAA-compliant Switch Chassis
- JH124A HP FlexFabric 7910 7.2Tbps TAA-compliant Fabric/Main Processing Unit
- JH125A HP FlexFabric 7910 2.4Tbps TAA-compliant Fabric/Main Processing Unit
5130 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG932A HP 5130-24G-4SFP+ EI Switch
- JG933A HP 5130-24G-SFP-4SFP+ EI Switch
- JG934A HP 5130-48G-4SFP+ EI Switch
- JG936A HP 5130-24G-PoE+-4SFP+ (370W) EI Switch
- JG937A HP 5130-48G-PoE+-4SFP+ (370W) EI Switch
- JG938A HP 5130-24G-2SFP+-2XGT EI Switch
- JG939A HP 5130-48G-2SFP+-2XGT EI Switch
- JG940A HP 5130-24G-PoE+-2SFP+-2XGT (370W) EI Switch
- JG941A HP 5130-48G-PoE+-2SFP+-2XGT (370W) EI Switch
- JG975A HP 5130-24G-4SFP+ EI Brazil Switch
- JG976A HP 5130-48G-4SFP+ EI Brazil Switch
- JG977A HP 5130-24G-PoE+-4SFP+ (370W) EI Brazil Switch
- JG978A HP 5130-48G-PoE+-4SFP+ (370W) EI Brazil Switch
6125XLG - Version: See Mitigation
- HP Network Products
- 711307-B21 HP 6125XLG Blade Switch
- 737230-B21 HP 6125XLG Blade Switch with TAA
6127XLG - Version: See Mitigation
- HP Network Products
- 787635 HP 6127XLG Blade Switch Opt Kit
Moonshot - Version: See Mitigation
- HP Network Products
- 786617-B21 - HP Moonshot-45Gc Switch Module
- 704654-B21 - HP Moonshot-45XGc Switch Module
- 786619-B21 - HP Moonshot-180XGc Switch Module
5700 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG894A HP FlexFabric 5700-48G-4XG-2QSFP+ Switch
- JG895A HP FlexFabric 5700-48G-4XG-2QSFP+ TAA-compliant Switch
- JG896A HP FlexFabric 5700-40XG-2QSFP+ Switch
- JG897A HP FlexFabric 5700-40XG-2QSFP+ TAA-compliant Switch
- JG898A HP FlexFabric 5700-32XGT-8XG-2QSFP+ Switch
- JG899A HP FlexFabric 5700-32XGT-8XG-2QSFP+ TAA-compliant Switch
5930 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG726A HP FlexFabric 5930 32QSFP+ Switch
- JG727A HP FlexFabric 5930 32QSFP+ TAA-compliant Switch
- JH178A HP FlexFabric 5930 2QSFP+ 2-slot Switch
- JH179A HP FlexFabric 5930 4-slot Switch
- JH187A HP FlexFabric 5930 2QSFP+ 2-slot TAA-compliant Switch
- JH188A HP FlexFabric 5930 4-slot TAA-compliant Switch
HSR6600 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG353A HP HSR6602-G Router
- JG354A HP HSR6602-XG Router
- JG776A HP HSR6602-G TAA-compliant Router
- JG777A HP HSR6602-XG TAA-compliant Router
HSR6800 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG361A HP HSR6802 Router Chassis
- JG361B HP HSR6802 Router Chassis
- JG362A HP HSR6804 Router Chassis
- JG362B HP HSR6804 Router Chassis
- JG363A HP HSR6808 Router Chassis
- JG363B HP HSR6808 Router Chassis
- JG364A HP HSR6800 RSE-X2 Router Main Processing Unit
- JG779A HP HSR6800 RSE-X2 Router TAA-compliant Main Processing
- JH075A HP HSR6800 RSE-X3 Router Main Processing Unit
1950 (Comware 7) - Version: See Mitigation
- HP Network Products
- JG960A HP 1950-24G-4XG Switch
- JG961A HP 1950-48G-2SFP+-2XGT Switch
- JG962A HP 1950-24G-2SFP+-2XGT-PoE+(370W) Switch
- JG963A HP 1950-48G-2SFP+-2XGT-PoE+(370W) Switch
7500 (Comware 7) - Version: See Mitigation
- HP Network Products
- JD238C HP 7510 Switch Chassis
- JD239C HP 7506 Switch Chassis
- JD240C HP 7503 Switch Chassis
- JD242C HP 7502 Switch Chassis
- JH207A HP 7500 1.2Tbps Fabric with 2-port 40GbE QSFP+ for IRF-Only Main Processing Unit
- JH208A HP 7502 Main Processing Unit
- JH209A HP 7500 2.4Tbps Fabric with 8-port 1/10GbE SFP+ and 2-port 40GbE QSFP+ Main Processing Unit
5950 (Comware 7) - Version: See Mitigation
- HP Network Products
- JH321A HPE FlexFabric 5950 32QSFP28 Switch
5940 (Comware 7) - Version: See Mitigation
- HP Network Products
- JH390A HPE FlexFabric 5940 48SFP+ 6QSFP28 Switch
- JH391A HPE FlexFabric 5940 48XGT 6QSFP28 Switch
- JH394A HPE FlexFabric 5940 48XGT 6QSFP+ Switch
- JH395A HPE FlexFabric 5940 48SFP+ 6QSFP+ Switch
- JH396A HPE FlexFabric 5940 32QSFP+ Switch
- JH397A HPE FlexFabric 5940 2-slot Switch
- JH398A HPE FlexFabric 5940 4-slot Switch

HISTORY Version:1 (rev.1) - 18 November 2016 Initial release

Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.

Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com

Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice

Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive

Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.

3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX

Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQEcBAEBCAAGBQJYLytTAAoJELXhAxt7SZaiMjYIAI4xgRNJCPqOZ40XLUNhxYrc HyqTd62PbcGOPTFya1qOo16V94eJ5id5oRHOtcrFjJKtDedDS6OoAe5HWYXvLEI3 0fEzCNjk9aHTcvuf2t17MGhS0Fk2JrZ0191RFONKuEkqgMmK0d44SGMrVXSA28Dj phW1dzm1HiJO0NPUOa+cYMhNt0+I7b+ulD6FdldNdqx4fNtlXiHvcRbF4Wffe2hD N2hlvx1Wu1iu2g75XPNPOPYhDRkyAm79P2HZGCUohQlhWsRgcJRnubojJBr7CMf9 2Ud7MwYL4jTKK/mFdim4ej/hwPn3SCb5ekhTUBFDlu2J2DjUYi2xDQgyQkhuUIg= =NGQO -----END PGP SIGNATURE----- .

Background

Mozilla Firefox is an open-source web browser and Mozilla Thunderbird an open-source email client, both from the Mozilla Project. The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as the =E2=80=98Mozilla Application Suite=E2=80=99. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact. ============================================================================ Ubuntu Security Notice USN-2031-1 November 20, 2013

firefox vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 13.10
Ubuntu 13.04
Ubuntu 12.10
Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in Firefox. (CVE-2013-1741, CVE-2013-2566, CVE-2013-5605, CVE-2013-5607)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 13.10: firefox 25.0.1+build1-0ubuntu0.13.10.1

Ubuntu 13.04: firefox 25.0.1+build1-0ubuntu0.13.04.1

Ubuntu 12.10: firefox 25.0.1+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS: firefox 25.0.1+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Firefox to make all the necessary changes.

References: http://www.ubuntu.com/usn/usn-2031-1 CVE-2013-1741, CVE-2013-2566, CVE-2013-5605, CVE-2013-5607, https://launchpad.net/bugs/1251576

Package Information: https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.13.10.1 https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.13.04.1 https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.12.10.1 https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.12.04.1 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2013:270 http://www.mandriva.com/en/support/security/

Package : nss Date : November 20, 2013 Affected: Business Server 1.0

Problem Description:

Multiple security issues was identified and fixed in mozilla NSPR and NSS:

Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure (CVE-2013-1739).

The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate (CVE-2013-5606).

Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741 (CVE-2013-5607).

The NSPR packages has been upgraded to the 4.10.2 version and the NSS packages has been upgraded to the 3.15.3 version which is unaffected by these security flaws.

Additionally the rootcerts packages has been upgraded with the latest certdata.txt file as of 2013/11/11 from mozilla.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1739 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1741 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2566 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5606 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5607 https://developer.mozilla.org/en-US/docs/NSS/NSS_3.15.3_release_notes http://www.mozilla.org/security/announce/2013/mfsa2013-103.html https://bugs.mageia.org/show_bug.cgi?id=11669

Updated Packages:

Mandriva Business Server 1/X86_64: af301c60ddcc18b8ac42c0b4435cbad3 mbs1/x86_64/lib64nspr4-4.10.2-1.mbs1.x86_64.rpm a496a08623a9f89d2399d80e4fe868a7 mbs1/x86_64/lib64nspr-devel-4.10.2-1.mbs1.x86_64.rpm ae3456fb3d674f99aef454a60dbe282a mbs1/x86_64/lib64nss3-3.15.3-1.mbs1.x86_64.rpm 9188809d70b632b2482acee08a4ddc0b mbs1/x86_64/lib64nss-devel-3.15.3-1.mbs1.x86_64.rpm 532704e8d72973d2dd61fe2698f893e4 mbs1/x86_64/lib64nss-static-devel-3.15.3-1.mbs1.x86_64.rpm 8f4ae3f02feb8d9f9c9efc8c257035e8 mbs1/x86_64/nss-3.15.3-1.mbs1.x86_64.rpm 8ae40ad195e46d8a2b30621dfcef3ace mbs1/x86_64/nss-doc-3.15.3-1.mbs1.noarch.rpm 59917a5345c7938ee1ac234a64a4cbfb mbs1/x86_64/rootcerts-20131111.00-1.mbs1.x86_64.rpm e118b1fef3401a9aad6502d31ac38bcc mbs1/x86_64/rootcerts-java-20131111.00-1.mbs1.x86_64.rpm 1cd846051eae1d454f8886ae6472da92 mbs1/SRPMS/nspr-4.10.2-1.mbs1.src.rpm f2b93d77bf10bb16f24803677c2a5432 mbs1/SRPMS/nss-3.15.3-1.mbs1.src.rpm 72294310b8fb899d0e04fe1762e77f75 mbs1/SRPMS/rootcerts-20131111.00-1.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSjJyxmqjQ0CJFipgRAvI3AJoDX5AXeQAKdSGxDE4mtdmcrtY3JACcDJzS 4rxtjYRyYkAzUzpzhQfi2B4= =dXuI -----END PGP SIGNATURE----- .

Background

The Mozilla Network Security Service is a library implementing security features like SSL v2/v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 dev-libs/nss < 3.15.3 >= 3.15.3

Description

Multiple vulnerabilities have been discovered in the Mozilla Network Security Service. Please review the CVE identifiers referenced below for more details about the vulnerabilities.

Impact

A remote attacker can cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Mozilla Network Security Service users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.15.3"

Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.

References

[ 1 ] CVE-2013-1620 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1620 [ 2 ] CVE-2013-1739 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1739 [ 3 ] CVE-2013-1741 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1741 [ 4 ] CVE-2013-2566 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2566 [ 5 ] CVE-2013-5605 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-5605 [ 6 ] CVE-2013-5606 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-5606 [ 7 ] CVE-2013-5607 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-5607

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201406-19.xml

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Show details on source website

JSON

To clipboard

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "hitachi",
        "version": "03-00-01"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 2.1,
        "vendor": "hitachi",
        "version": "02-03"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 2.1,
        "vendor": "hitachi",
        "version": "02-00"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 2.1,
        "vendor": "hitachi",
        "version": "02-02"
      },
      {
        "_id": null,
        "model": "web server 02-04-/b",
        "scope": null,
        "trust": 2.1,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 2.1,
        "vendor": "hitachi",
        "version": "03-00"
      },
      {
        "_id": null,
        "model": "web server 02-04-/c",
        "scope": null,
        "trust": 1.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base )",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform )",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base )",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "03-00-02"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "web server 02-04-/f",
        "scope": null,
        "trust": 1.5,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "web server 02-04-/a",
        "scope": null,
        "trust": 1.5,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "03-10"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform )",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus application server )",
        "scope": "eq",
        "trust": 1.5,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "02-01"
      },
      {
        "_id": null,
        "model": "ucosminexus client",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "01-01"
      },
      {
        "_id": null,
        "model": "web server 02-04-/e",
        "scope": null,
        "trust": 1.2,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 1.2,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "m10-4s",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp"
      },
      {
        "_id": null,
        "model": "http server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "17.0.11"
      },
      {
        "_id": null,
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2280"
      },
      {
        "_id": null,
        "model": "integrated lights out manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0.4"
      },
      {
        "_id": null,
        "model": "http server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.1.7.0"
      },
      {
        "_id": null,
        "model": "sparc enterprise m8000",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp"
      },
      {
        "_id": null,
        "model": "http server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.2.0"
      },
      {
        "_id": null,
        "model": "m10-1",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp"
      },
      {
        "_id": null,
        "model": "sparc enterprise m8000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp_1121"
      },
      {
        "_id": null,
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2280"
      },
      {
        "_id": null,
        "model": "integrated lights out manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0.0"
      },
      {
        "_id": null,
        "model": "sparc enterprise m4000",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp"
      },
      {
        "_id": null,
        "model": "http server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.1.0"
      },
      {
        "_id": null,
        "model": "sparc enterprise m5000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp_1121"
      },
      {
        "_id": null,
        "model": "thunderbird esr",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "17.0.11"
      },
      {
        "_id": null,
        "model": "sparc enterprise m4000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp_1121"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "24.1.1"
      },
      {
        "_id": null,
        "model": "sparc enterprise m5000",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp"
      },
      {
        "_id": null,
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "13.10"
      },
      {
        "_id": null,
        "model": "thunderbird",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "24.1.1"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "25.0.1"
      },
      {
        "_id": null,
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "12.10"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "24.1.0"
      },
      {
        "_id": null,
        "model": "sparc enterprise m9000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp_1121"
      },
      {
        "_id": null,
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2280"
      },
      {
        "_id": null,
        "model": "integrated lights out manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.2.11"
      },
      {
        "_id": null,
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "12.04"
      },
      {
        "_id": null,
        "model": "sparc enterprise m9000",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp"
      },
      {
        "_id": null,
        "model": "sparc enterprise m3000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp_1121"
      },
      {
        "_id": null,
        "model": "m10-4",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "2.22.1"
      },
      {
        "_id": null,
        "model": "http server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.1.9.0"
      },
      {
        "_id": null,
        "model": "sparc enterprise m3000",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp"
      },
      {
        "_id": null,
        "model": "communications application session controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.9.1"
      },
      {
        "_id": null,
        "model": "integrated lights out manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0.0"
      },
      {
        "_id": null,
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "13.04"
      },
      {
        "_id": null,
        "model": "communications application session controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0.0"
      },
      {
        "_id": null,
        "model": "web server 01-02-/b",
        "scope": null,
        "trust": 0.9,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus application server )",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect )",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r )",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus client",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect )",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus developer )",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "web server 01-02-/c",
        "scope": null,
        "trust": 0.9,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "01-02"
      },
      {
        "_id": null,
        "model": "ucosminexus operator for service platform",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "web server 01-02-/d",
        "scope": null,
        "trust": 0.9,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "web server linux",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "04-00"
      },
      {
        "_id": null,
        "model": "ucosminexus operator for service platform",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "web server 01-02-/a",
        "scope": null,
        "trust": 0.9,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r )",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform hp-ux",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "03-10-01"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "hitachi",
        "version": "03-00-05"
      },
      {
        "_id": null,
        "model": "ucosminexus client )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus application server (windows(x8",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "web server 01-02-/e",
        "scope": null,
        "trust": 0.6,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base (windows(x6",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "web server 02-04-/d",
        "scope": null,
        "trust": 0.6,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "_id": null,
        "model": "ucosminexus operator for service platform )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "web server linux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "03-00"
      },
      {
        "_id": null,
        "model": "web server 01-01-/d",
        "scope": null,
        "trust": 0.6,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "ucosminexus application server (windows(x6",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "cosminexus http server windows",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "web server hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "03-00"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform (windows(x6",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "_id": null,
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base (windows(x8",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform (windows(x8",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "ucosminexus application server hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus client )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "01-00"
      },
      {
        "_id": null,
        "model": "ucosminexus application server hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "02-04"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform (windows(x6",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "ucosminexus operator for service platform )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base (windows(x6",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "ucosminexus developer )",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus application server (windows(x6",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "04-10-02"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "_id": null,
        "model": "ucosminexus application server hp-ux",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "sparc-opl service processor",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "oracle",
        "version": "1121"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "5.0.375127"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "_id": null,
        "model": "fujitsu m10-4 server xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2271"
      },
      {
        "_id": null,
        "model": "cyberfox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "8pecxstudios",
        "version": "22.0"
      },
      {
        "_id": null,
        "model": "(comware r2122",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "79007)"
      },
      {
        "_id": null,
        "model": "sparc enterprise m5000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1118"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "ucosminexus developer (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.11"
      },
      {
        "_id": null,
        "model": "productions pale moon",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "moonchild",
        "version": "24.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.0.2"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "big-ip apm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "productions pale moon",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "moonchild",
        "version": "24.1.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "6.0.47255"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "ei (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "51205)0"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "web server 04-10",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.5"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.50"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-10"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.63"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.0"
      },
      {
        "_id": null,
        "model": "productions pale moon",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "moonchild",
        "version": "20.3"
      },
      {
        "_id": null,
        "model": "6127xlg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.47"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "10.0.648.127"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.0.14.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.225"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-10-03"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.50"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.12"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.17"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.219"
      },
      {
        "_id": null,
        "model": "jd814a hp a-imc enterprise edition software dvd media",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-03"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-10-03"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-10-01(x64)"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.43"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.04"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.23"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-10-04"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.11"
      },
      {
        "_id": null,
        "model": "jf378aae hp imc ent s/w pltfrm w/200-node e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.2.4"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "17.0.96365"
      },
      {
        "_id": null,
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.2"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.51"
      },
      {
        "_id": null,
        "model": "web server 2).(sola",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-01(*"
      },
      {
        "_id": null,
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "2.1"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.1"
      },
      {
        "_id": null,
        "model": "web server (hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "01-0011.0)"
      },
      {
        "_id": null,
        "model": "communications session border controller scz7.3.0",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.40"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.1"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "fujitsu m10-1 server xcp",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2280"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "16.0.912.77"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.2"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.5"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "23.0.1271.95"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.35"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.2"
      },
      {
        "_id": null,
        "model": "sparc enterprise m4000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1118"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect (windows(x8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.195"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "12.10"
      },
      {
        "_id": null,
        "model": "jg768aae hp pcm+ to imc std upg w/ 200-node e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.200"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.39"
      },
      {
        "_id": null,
        "model": "abyp-2t-1s-1l-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "abyp-10g-2sr-2lr-1-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "arx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "6.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "4"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.14"
      },
      {
        "_id": null,
        "model": "jd815a hp imc std platform w/100-node license",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.22"
      },
      {
        "_id": null,
        "model": "cosminexus application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.303"
      },
      {
        "_id": null,
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.1"
      },
      {
        "_id": null,
        "model": "internet explorer sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0.1"
      },
      {
        "_id": null,
        "model": "big-ip analytics hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "software opera web browser 1win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.211"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.104"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "8.51"
      },
      {
        "_id": null,
        "model": "web server )",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-03"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.1.2"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1"
      },
      {
        "_id": null,
        "model": "hsr6800 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "abyp-10g-4lr-1-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "3.0.195.24"
      },
      {
        "_id": null,
        "model": "sparc enterprise m9000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1117"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0.0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.66"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "web server 04-00.",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3.2.2"
      },
      {
        "_id": null,
        "model": "web server 02-00/a",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "safari beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.3"
      },
      {
        "_id": null,
        "model": "cosminexus application server enterprise",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.17"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.2"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.00"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.8"
      },
      {
        "_id": null,
        "model": "jf289aae hp enterprise management system to intelligent manageme",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "communications application session controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "13.0.782.107"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "14"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.52"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r (windows(x8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.54"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.51"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0.195"
      },
      {
        "_id": null,
        "model": "big-ip wom hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.0"
      },
      {
        "_id": null,
        "model": "web server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-10"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1"
      },
      {
        "_id": null,
        "model": "abyp-10g-4sr-1-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.30"
      },
      {
        "_id": null,
        "model": "business service automation essentials core",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "9.2"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.2.2"
      },
      {
        "_id": null,
        "model": "enterprise session border controller ecz7.3m2p2",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.10"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.7"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.2"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "5.12"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "25.0.1364160"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "4.0.211.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "16.0.912.63"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "26.0.1410.43"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.00"
      },
      {
        "_id": null,
        "model": "web server (hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-0011.0)"
      },
      {
        "_id": null,
        "model": "big-ip apm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "1.0.154.36"
      },
      {
        "_id": null,
        "model": "fujitsu m10-1 server xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2271"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.095"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "3.0.195.32"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.25"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.0.1"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.0.198"
      },
      {
        "_id": null,
        "model": "big-ip psm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "5.02"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.19"
      },
      {
        "_id": null,
        "model": "glassfish",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.0.1"
      },
      {
        "_id": null,
        "model": "si (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "51205)0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1.2"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.4.80"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.1"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.095"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.24"
      },
      {
        "_id": null,
        "model": "big-ip asm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "11.0.696.65"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.2"
      },
      {
        "_id": null,
        "model": "jg549aae hp pcm+ to imc std upgr w/200-node e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.00"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.60"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.00"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.100"
      },
      {
        "_id": null,
        "model": "cyberfox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "8pecxstudios",
        "version": "24.0"
      },
      {
        "_id": null,
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "_id": null,
        "model": "f1000-a-ei (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "rsa validation manager build",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "emc",
        "version": "3.2201"
      },
      {
        "_id": null,
        "model": "cosminexus http server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "internet explorer sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0.1"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "14"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "125005)0"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16.0.2"
      },
      {
        "_id": null,
        "model": "sparc enterprise m5000 xcp",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1121"
      },
      {
        "_id": null,
        "model": "big-ip asm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.00"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "16"
      },
      {
        "_id": null,
        "model": "msr (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "30-1x5)0"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "8.0.7600.16385"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.13"
      },
      {
        "_id": null,
        "model": "big-iq cloud",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "17"
      },
      {
        "_id": null,
        "model": "cosminexus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "9.0"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-10-10"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.3"
      },
      {
        "_id": null,
        "model": "cosminexus primary server base",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.4"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1.1"
      },
      {
        "_id": null,
        "model": "ucosminexus application server enterprise )",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-80"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "productions pale moon",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "moonchild",
        "version": "24.1.1"
      },
      {
        "_id": null,
        "model": "jg548aae hp pcm+ to imc bsc upgr w/50-node e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.13"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "10.0.648.133"
      },
      {
        "_id": null,
        "model": "abyp-0t-0s-4l-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.2.3"
      },
      {
        "_id": null,
        "model": "internet explorer beta3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "4.1.2491059"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "18"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-060"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.101"
      },
      {
        "_id": null,
        "model": "ucosminexus application server smart edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.4.80"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.03"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "8.52"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.15"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.1"
      },
      {
        "_id": null,
        "model": "cosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.098"
      },
      {
        "_id": null,
        "model": "internet explorer beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "81"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.11"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "7.0.5730.11"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.37"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.52"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1"
      },
      {
        "_id": null,
        "model": "ucosminexus developer light",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.7"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.1.2"
      },
      {
        "_id": null,
        "model": "jg767aae hp imc smcnct wsm vrtl applnc sw e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.89"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "1.0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.6"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.6"
      },
      {
        "_id": null,
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.4"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "23.0.1271.97"
      },
      {
        "_id": null,
        "model": "arx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "6.1"
      },
      {
        "_id": null,
        "model": "big-ip analytics hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.67"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0.00"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.5.7"
      },
      {
        "_id": null,
        "model": "jd126a hp imc ent s/w platform w/100-node",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "_id": null,
        "model": "sparc enterprise m4000 xcp",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1121"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.17"
      },
      {
        "_id": null,
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "2.3"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "125007)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "7.0.548.0"
      },
      {
        "_id": null,
        "model": "ucosminexus developer professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.7"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.5"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "8.54"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "9.0.597.84"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "17.0.963.56"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "2.0.4"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "58305)0"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.3"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.0.2"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "13.37"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "75005)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "2.0.172.31"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.53"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "7.0.517.43"
      },
      {
        "_id": null,
        "model": "sparc enterprise m8000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1118"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.39"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.21"
      },
      {
        "_id": null,
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "3.1.1"
      },
      {
        "_id": null,
        "model": "msr4000 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.83"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "11"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "58005)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "7.0.517.41"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0.0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "safari for osx lion",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "6"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4.0.4"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.75"
      },
      {
        "_id": null,
        "model": "big-ip psm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "sparc enterprise m3000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1118"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.4"
      },
      {
        "_id": null,
        "model": "web server (linux for",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "01-01(*2)"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "12"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "12.0.742.100"
      },
      {
        "_id": null,
        "model": "u200a and m (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.12"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "5"
      },
      {
        "_id": null,
        "model": "big-ip afm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "17.0.963.60"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.105"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "8.0"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.306"
      },
      {
        "_id": null,
        "model": "abyp-4tl-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.64"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "20.0.1"
      },
      {
        "_id": null,
        "model": "productions pale moon",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "moonchild",
        "version": "20.0.1"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.04"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.13"
      },
      {
        "_id": null,
        "model": "hsr6602 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1"
      },
      {
        "_id": null,
        "model": "web server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-10-02"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-10-01"
      },
      {
        "_id": null,
        "model": "software opera web browser win32 beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.01"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "14.01"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "25.0.1364.172"
      },
      {
        "_id": null,
        "model": "big-ip apm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0"
      },
      {
        "_id": null,
        "model": "big-ip afm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "9.0.597.107"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "web server 02-04/-e",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "web server solaris",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-01"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "17.0.96379"
      },
      {
        "_id": null,
        "model": "software opera web browser linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.217"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.21"
      },
      {
        "_id": null,
        "model": "big-ip psm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "59307)0"
      },
      {
        "_id": null,
        "model": "msr3000 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7)0"
      },
      {
        "_id": null,
        "model": "business server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "1"
      },
      {
        "_id": null,
        "model": "business service automation essentials core",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "9.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.22"
      },
      {
        "_id": null,
        "model": "web server 02-04-/a (windows",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1.1"
      },
      {
        "_id": null,
        "model": "web server security enhancement",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "-0"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "2.0.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.51"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "11.0.696.77"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.2.3"
      },
      {
        "_id": null,
        "model": "safari beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "20.0.1132.23"
      },
      {
        "_id": null,
        "model": "6125xlg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "web server (hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-0011.0)"
      },
      {
        "_id": null,
        "model": "internet explorer sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "20.0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1.1"
      },
      {
        "_id": null,
        "model": "arx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "6.4"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "13.0.782.112"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "6.0.2"
      },
      {
        "_id": null,
        "model": "productions pale moon",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "moonchild",
        "version": "20.1"
      },
      {
        "_id": null,
        "model": "abyp-2t-1s-1l-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.344"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-01"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "1.0.154.48"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "75007)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "13.0.782.215"
      },
      {
        "_id": null,
        "model": "web server 02-04-/a (windows ip",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.4"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "1.0.154.64"
      },
      {
        "_id": null,
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "64"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.4"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "14.0.835.202"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "11.0.696.57"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "105007)0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.15"
      },
      {
        "_id": null,
        "model": "big-ip afm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.10"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.14"
      },
      {
        "_id": null,
        "model": "abyp-2t-2s-0l-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "18.0.1025.168"
      },
      {
        "_id": null,
        "model": "big-ip pem",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "10"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.31"
      },
      {
        "_id": null,
        "model": "firepass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "6.1"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "25.0"
      },
      {
        "_id": null,
        "model": "web server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-05"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.13"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "fujitsu m10-4s server xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2271"
      },
      {
        "_id": null,
        "model": "abyp-0t-4s-0l-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "27.0.14443"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.16"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1"
      },
      {
        "_id": null,
        "model": "big-ip aam",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.215"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.15"
      },
      {
        "_id": null,
        "model": "software opera web browser j",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.11"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.1"
      },
      {
        "_id": null,
        "model": "big-ip asm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.302"
      },
      {
        "_id": null,
        "model": "fujitsu m10-4s server xcp",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2280"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.9"
      },
      {
        "_id": null,
        "model": "ucosminexus developer hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "cosminexus developer standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "big-ip psm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "big-ip psm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "big-ip wom hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4.0.3"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.34"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-04"
      },
      {
        "_id": null,
        "model": "big-ip asm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "smb1920 (comware r1106",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)"
      },
      {
        "_id": null,
        "model": "web server 02-04-/b (hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.13"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.27"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.50"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "59007)0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.22"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2"
      },
      {
        "_id": null,
        "model": "chrome beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "3.0"
      },
      {
        "_id": null,
        "model": "big-ip afm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "msr (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "9xx5)0"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.19"
      },
      {
        "_id": null,
        "model": "moonshot",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "11.0.696.68"
      },
      {
        "_id": null,
        "model": "u200s and cs (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.25"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.549.0"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "14.1"
      },
      {
        "_id": null,
        "model": "abyp-2t-0s-2l-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "8.50"
      },
      {
        "_id": null,
        "model": "big-ip psm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.207"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1.4"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.2.1"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-03"
      },
      {
        "_id": null,
        "model": "internet explorer for wfw",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.0"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "internet explorer for wfw",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.2"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.3"
      },
      {
        "_id": null,
        "model": "big-ip analytics 11.0.0-hf2",
        "scope": null,
        "trust": 0.3,
        "vendor": "f5",
        "version": null
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.06"
      },
      {
        "_id": null,
        "model": "enterprise server x86 64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandrakesoft",
        "version": "5"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.29"
      },
      {
        "_id": null,
        "model": "big-ip afm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.7"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "26.0.1410.28"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "20"
      },
      {
        "_id": null,
        "model": "web server )",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-02"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.1"
      },
      {
        "_id": null,
        "model": "ucosminexus developer professional for plug-in",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "security siteprotector system",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.1.1"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-01(*2)"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.223"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.12"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "9500e (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "1.0.154.46"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.23"
      },
      {
        "_id": null,
        "model": "msr20 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "cosminexus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "software opera web browser linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0.3"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "13"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.4"
      },
      {
        "_id": null,
        "model": "internet explorer beta2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.60"
      },
      {
        "_id": null,
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "5.0.375125"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.2.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "10.0.648.128"
      },
      {
        "_id": null,
        "model": "web server (hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-0111.0"
      },
      {
        "_id": null,
        "model": "hp830 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "24.0.1312.56"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.21"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.4"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.6"
      },
      {
        "_id": null,
        "model": "software opera web browser beta build",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.2012981"
      },
      {
        "_id": null,
        "model": "msr (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "93x5)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.222"
      },
      {
        "_id": null,
        "model": "internet explorer sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "12.02"
      },
      {
        "_id": null,
        "model": "sparc enterprise m8000 xcp",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1121"
      },
      {
        "_id": null,
        "model": "abyp-0t-4s-0l-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "22.0.1229.79"
      },
      {
        "_id": null,
        "model": "4800g (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.098"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.33"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.0.24.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.16"
      },
      {
        "_id": null,
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.5"
      },
      {
        "_id": null,
        "model": "cyberfox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "8pecxstudios",
        "version": "23.0"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.24"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.43"
      },
      {
        "_id": null,
        "model": "ucosminexus developer (windows(x8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-05"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "5.0.37599"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "12.00"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "8"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "12.13"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "big-iq cloud",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.2"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "8.53"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.82"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "2.0.172.37"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.14"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.19"
      },
      {
        "_id": null,
        "model": "ucosminexus developer professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.551.1"
      },
      {
        "_id": null,
        "model": "glassfish enterprise server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sun",
        "version": "2.1.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.11"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.01"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "22"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.20"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.1.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "12"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.57"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.0.4"
      },
      {
        "_id": null,
        "model": "big-ip asm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "12.01"
      },
      {
        "_id": null,
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "1.8"
      },
      {
        "_id": null,
        "model": "websphere application server fix pack",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.217"
      },
      {
        "_id": null,
        "model": "jg747aae hp imc std sw plat w/ nodes e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "500"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.23"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.53"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "17.0.963.46"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.3.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.61"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.220"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.10"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "13.10"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-03"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.11"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "25.0.1364.99"
      },
      {
        "_id": null,
        "model": "big-ip psm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "5.0.375.70"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.5"
      },
      {
        "_id": null,
        "model": "glassfish enterprise server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sun",
        "version": "3.0.1"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "abyp-10g-2sr-2lr-1-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.10"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.102"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.10"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "65"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.9"
      },
      {
        "_id": null,
        "model": "software opera web browser linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.10"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.20"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "24.0.1312.57"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.16"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0.5"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.10"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00(64)"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-10-03(x64)"
      },
      {
        "_id": null,
        "model": "web server aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.3"
      },
      {
        "_id": null,
        "model": "internet explorer sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.0.1"
      },
      {
        "_id": null,
        "model": "big-ip asm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.19"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.4"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0.1"
      },
      {
        "_id": null,
        "model": "big-iq security",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.0"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "15.0.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.224"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.13"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "2.0.2"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.61"
      },
      {
        "_id": null,
        "model": "sparc enterprise m4000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1117"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.03.1"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "ucosminexus developer standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.7"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-10-02"
      },
      {
        "_id": null,
        "model": "big-ip apm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "17.0.963.78"
      },
      {
        "_id": null,
        "model": "jf377a hp imc std s/w platform w/100-node lic",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.308"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.7"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "_id": null,
        "model": "big-ip analytics hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "ucosminexus developer hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "4.0.249.89"
      },
      {
        "_id": null,
        "model": "web server 01-02-/d (hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.54"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.295"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.5.2"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.28"
      },
      {
        "_id": null,
        "model": "software opera web browser .6win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "hp870 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "smb (comware r1105",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "16205)"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.201"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.11"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "11.0.672.2"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.021"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "10"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.62"
      },
      {
        "_id": null,
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "3.1"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.237"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "6.0.472.53"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.3"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-60"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.8"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.9"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50-02"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1"
      },
      {
        "_id": null,
        "model": "(comware r3108p03",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "51307)"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "3.0.195.21"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.6"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.5.1"
      },
      {
        "_id": null,
        "model": "hi (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "55005)0"
      },
      {
        "_id": null,
        "model": "big-ip aam",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "_id": null,
        "model": "jg550aae hp pmm to imc bsc wlm upgr w/150ap e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.49"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.029"
      },
      {
        "_id": null,
        "model": "web server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.18"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.213"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "59507)0"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "rc4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rsa",
        "version": "0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.0.295"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-2"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.4"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.1"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.15"
      },
      {
        "_id": null,
        "model": "ucosminexus application server standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.5.0.0"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "22.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.218"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.0.1"
      },
      {
        "_id": null,
        "model": "msr2000 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "25.0.1364.152"
      },
      {
        "_id": null,
        "model": "f1000-e (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.1.0"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-10"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.1"
      },
      {
        "_id": null,
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.27"
      },
      {
        "_id": null,
        "model": "jd808a hp imc ent platform w/100-node license",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.1.3"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.7"
      },
      {
        "_id": null,
        "model": "jd816a hp a-imc standard edition software dvd media",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0.198"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10"
      },
      {
        "_id": null,
        "model": "software opera web browser mac",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.03"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.216"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.79"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "13.04"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "12.11"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "2.0.172.30"
      },
      {
        "_id": null,
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "productions pale moon",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "moonchild",
        "version": "24.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "4.1.249.1042"
      },
      {
        "_id": null,
        "model": "software opera web browser b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.11"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.18"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.1"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.5"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "1.0.154.53"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1.4"
      },
      {
        "_id": null,
        "model": "secblade fw (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.01"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.12"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.31"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "3.0.195.38"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16.0.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.21"
      },
      {
        "_id": null,
        "model": "abyp-4ts-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "ucosminexus developer (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.17"
      },
      {
        "_id": null,
        "model": "glassfish enterprise server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sun",
        "version": "2.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "3.0.195.33"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.15"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4.0.5"
      },
      {
        "_id": null,
        "model": "internet explorer sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0.1"
      },
      {
        "_id": null,
        "model": "big-ip aam",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.02"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "safari for osx lion",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1.6"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.310"
      },
      {
        "_id": null,
        "model": "4500g (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "big-ip apm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.62"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "web server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-10-01"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.33"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.8"
      },
      {
        "_id": null,
        "model": "abyp-0t-2s-2l-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "1.6"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.14"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.45"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.11"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "1.0.154.61"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.4"
      },
      {
        "_id": null,
        "model": "cosminexus primary server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.1"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "6.0.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.202"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.17"
      },
      {
        "_id": null,
        "model": "fujitsu m10-4 server xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2230"
      },
      {
        "_id": null,
        "model": "jf378a hp imc ent s/w platform w/200-node lic",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.60"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.31"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "24.0.1312.52"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.12"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-05"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.5"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.62"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.2.2"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "5.10"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.3"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.2.1"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.33"
      },
      {
        "_id": null,
        "model": "safari beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.2"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.1"
      },
      {
        "_id": null,
        "model": "big-ip wom hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "14.0.835.186"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.7"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.13"
      },
      {
        "_id": null,
        "model": "safari beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.1"
      },
      {
        "_id": null,
        "model": "big-ip asm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "security siteprotector system",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0"
      },
      {
        "_id": null,
        "model": "web server 01-02-/d (hp-ux",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "jboss application server 7.1.1.final",
        "scope": null,
        "trust": 0.3,
        "vendor": "redhat",
        "version": null
      },
      {
        "_id": null,
        "model": "cosminexus application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "4.1.2491036"
      },
      {
        "_id": null,
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "2.0"
      },
      {
        "_id": null,
        "model": "big-ip analytics hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "9.0.597.94"
      },
      {
        "_id": null,
        "model": "cosminexus http server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-10"
      },
      {
        "_id": null,
        "model": "big-ip analytics hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "big-ip pem",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "security siteprotector system",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0.1"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-02"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "8.02"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.23"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "web server 02-06-/a",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.52"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "10.0.648.204"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.551.0"
      },
      {
        "_id": null,
        "model": "big-ip apm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.301"
      },
      {
        "_id": null,
        "model": "internet explorer for wfw",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.0"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.14"
      },
      {
        "_id": null,
        "model": "abyp-10g-4sr-1-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "vsr (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7)0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.02"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1.7"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.6"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "productions pale moon",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "moonchild",
        "version": "20.2"
      },
      {
        "_id": null,
        "model": "sparc enterprise m8000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1117"
      },
      {
        "_id": null,
        "model": "big-ip apm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "ucosminexus application server standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.7"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.13.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "12.0.742.112"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "8.0.2"
      },
      {
        "_id": null,
        "model": "hsr6800 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "6.0.472.62"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.15"
      },
      {
        "_id": null,
        "model": "big-ip wom hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.095"
      },
      {
        "_id": null,
        "model": "sparc enterprise m3000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1117"
      },
      {
        "_id": null,
        "model": "web server )",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-04"
      },
      {
        "_id": null,
        "model": "safari beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4"
      },
      {
        "_id": null,
        "model": "big-ip analytics hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.52"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.6"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.01"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "ucosminexus developer standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.3.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "4.0.249.78"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.11"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.9"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "_id": null,
        "model": "sparc enterprise m9000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1118"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "web server 04-00-03.",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.0.3"
      },
      {
        "_id": null,
        "model": "rse ru r3303p18",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "66005"
      },
      {
        "_id": null,
        "model": "msr (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "30-165)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "15.0.874102"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.4.8"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.60"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.2"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.64"
      },
      {
        "_id": null,
        "model": "abyp-4tl-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.6"
      },
      {
        "_id": null,
        "model": "big-ip pem",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "3"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "18.0"
      },
      {
        "_id": null,
        "model": "big-ip apm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "19.0.1084.21"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "21.0.1180.81"
      },
      {
        "_id": null,
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.20"
      },
      {
        "_id": null,
        "model": "big-ip asm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.1.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.300"
      },
      {
        "_id": null,
        "model": "software opera web browser beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.50"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.51"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.29"
      },
      {
        "_id": null,
        "model": "web server linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-10-01"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "24.0.1312.70"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "19.0.1084.52"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "ucosminexus primary server base",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "14.0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.22"
      },
      {
        "_id": null,
        "model": "abyp-4t-0s-0l-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.205"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.204"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.10"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "6.0.3"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.9"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.6.1"
      },
      {
        "_id": null,
        "model": "big-ip analytics hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "jg766aae hp imc smcnct vrtl applnc sw e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "2.0.172.33"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.103"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "11.0.696.71"
      },
      {
        "_id": null,
        "model": "ucosminexus client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip psm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.0.195"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "12.0.742.91"
      },
      {
        "_id": null,
        "model": "software opera web browser beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.601"
      },
      {
        "_id": null,
        "model": "web server solaris",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.210"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.32"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "_id": null,
        "model": "web server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-01"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.11"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.309"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.214"
      },
      {
        "_id": null,
        "model": "big-ip pem",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00(x64)"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.13.1"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "web server )",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.1"
      },
      {
        "_id": null,
        "model": "big-iq security",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "fujitsu m10-1 server xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2230"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.27"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.2.2"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "2.0.3"
      },
      {
        "_id": null,
        "model": "jf377aae hp imc std s/w pltfrm w/100-node e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.5.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "14.0.835.163"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.2.2"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.5"
      },
      {
        "_id": null,
        "model": "internet explorer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "9"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.23.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.304"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "18.0.1025.162"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.305"
      },
      {
        "_id": null,
        "model": "ucosminexus application server enterprise",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.7"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.8"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.20"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4.2"
      },
      {
        "_id": null,
        "model": "cosminexus developer professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.50"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.3"
      },
      {
        "_id": null,
        "model": "cosminexus application server no version",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3"
      },
      {
        "_id": null,
        "model": "internet explorer sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.5"
      },
      {
        "_id": null,
        "model": "sparc enterprise m5000 xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1117"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.1"
      },
      {
        "_id": null,
        "model": "cosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "jg748aae hp imc ent sw plat w/ nodes e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "500"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.17"
      },
      {
        "_id": null,
        "model": "5500si (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "big-ip wom hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.2"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.0"
      },
      {
        "_id": null,
        "model": "ei (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "55005)0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4.0.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.52"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "16.0.912.75"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.203"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "5.1"
      },
      {
        "_id": null,
        "model": "web server 02-06-/f",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.4"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "20.0.1132.43"
      },
      {
        "_id": null,
        "model": "web server aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00"
      },
      {
        "_id": null,
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "firepass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "internet explorer beta1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "communications session border controller scz7.4.0",
        "scope": null,
        "trust": 0.3,
        "vendor": "oracle",
        "version": null
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "14.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.208"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.2"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7.02"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.10"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.03"
      },
      {
        "_id": null,
        "model": "big-ip asm hf7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.198"
      },
      {
        "_id": null,
        "model": "ucosminexus application server express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-70"
      },
      {
        "_id": null,
        "model": "web server security enhancement 02-04-/b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "glassfish enterprise server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sun",
        "version": "3.1.1"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "13.0"
      },
      {
        "_id": null,
        "model": "internet explorer sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.25"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.2"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.13"
      },
      {
        "_id": null,
        "model": "big-ip apm hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.2.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "15.0.874.120"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.4.8"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.1.1"
      },
      {
        "_id": null,
        "model": "msr 50-g2 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.209"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.226"
      },
      {
        "_id": null,
        "model": "arx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.15"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "19"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.10"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0.5"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "15.0.874.121"
      },
      {
        "_id": null,
        "model": "cyberfox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "8pecxstudios",
        "version": "25.0"
      },
      {
        "_id": null,
        "model": "big-ip analytics hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.0.5"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.04"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "15"
      },
      {
        "_id": null,
        "model": "arx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "6.3"
      },
      {
        "_id": null,
        "model": "cosminexus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "8.0"
      },
      {
        "_id": null,
        "model": "big-ip asm hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "6.0.1"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "cyberfox",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "8pecxstudios",
        "version": "25.0.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.23"
      },
      {
        "_id": null,
        "model": "jg660aae hp imc smart connect w/wlm vae e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0.12000"
      },
      {
        "_id": null,
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "3.0"
      },
      {
        "_id": null,
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "010"
      },
      {
        "_id": null,
        "model": "big-ip aam",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "1.0.154.55"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.27"
      },
      {
        "_id": null,
        "model": "cosminexus application server standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-00-04"
      },
      {
        "_id": null,
        "model": "big-ip ltm hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "11.65"
      },
      {
        "_id": null,
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.2.3"
      },
      {
        "_id": null,
        "model": "msr1000 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "7)0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.18"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.9"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1.5"
      },
      {
        "_id": null,
        "model": "msr20-1x (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "12.0"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4.2.3"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.8"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "4.1.2491064"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.2"
      },
      {
        "_id": null,
        "model": "ucosminexus service architect hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-50"
      },
      {
        "_id": null,
        "model": "abyp-10g-4lr-1-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "sparc enterprise m9000 xcp",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1121"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.23"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "web server 02-06-/b",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "web server (hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "01-0010.20)"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.00"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "16.0.91275"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "5.0.375.55"
      },
      {
        "_id": null,
        "model": "abyp-0t-0s-4l-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "abyp-4t-0s-0l-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.7"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.1"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "25.0.1"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.10"
      },
      {
        "_id": null,
        "model": "web server 02-04-/a (windows(ip",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.5"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.0.2"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.5"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "25.0.1364.97"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1.7"
      },
      {
        "_id": null,
        "model": "cosminexus http server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-10"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "4.1.249.1045"
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "5.x"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.10"
      },
      {
        "_id": null,
        "model": "software opera web browser 3win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "3.0.14.0"
      },
      {
        "_id": null,
        "model": "abyp-0t-2s-2l-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-iq security",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "18.0.1025.151"
      },
      {
        "_id": null,
        "model": "software opera web browser 2win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "8.01"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "15"
      },
      {
        "_id": null,
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.3"
      },
      {
        "_id": null,
        "model": "internet explorer beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "82"
      },
      {
        "_id": null,
        "model": "web server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "03-10-09"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "internet explorer sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "jg546aae hp imc basic sw platform w/50-node e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "108"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0.6"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0.4"
      },
      {
        "_id": null,
        "model": "internet explorer rc1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "8"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.5"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "19.0.2"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.19"
      },
      {
        "_id": null,
        "model": "cosminexus primary server base",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.02000"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.141"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.4.8"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r (windows(x6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.4.80"
      },
      {
        "_id": null,
        "model": "internet explorer for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "4.03.1"
      },
      {
        "_id": null,
        "model": "4210g (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "web server hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00-04"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "1.0.154.59"
      },
      {
        "_id": null,
        "model": "enterprise server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandrakesoft",
        "version": "5"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.20"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.63"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "8.0.0.4"
      },
      {
        "_id": null,
        "model": "msr (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "305)0"
      },
      {
        "_id": null,
        "model": "business server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "1x8664"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "19.0"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "2.0.172.43"
      },
      {
        "_id": null,
        "model": "jd125a hp imc std s/w platform w/100-node",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "f5000-c/s (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "ucosminexus application server-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-02"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.14"
      },
      {
        "_id": null,
        "model": "sparc enterprise m3000 xcp",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1121"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "1.0.154.65"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "12.12"
      },
      {
        "_id": null,
        "model": "arx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "6.1.1"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "59207)0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "5.12"
      },
      {
        "_id": null,
        "model": "big-ip link controller hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "big-iq cloud",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.0"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.4.5"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0.2"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "cosminexus http server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-10"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "25"
      },
      {
        "_id": null,
        "model": "firepass",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.0"
      },
      {
        "_id": null,
        "model": "rsa validation manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "emc",
        "version": "3.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "9"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.0.2.11"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "6.0.472.59"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "105005)0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.33"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.1"
      },
      {
        "_id": null,
        "model": "cosminexus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "20.0.1132.57"
      },
      {
        "_id": null,
        "model": "msr1000 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "internet explorer preview",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.5"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "9.0"
      },
      {
        "_id": null,
        "model": "fujitsu m10-4 server xcp",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2280"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.7"
      },
      {
        "_id": null,
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "big-ip psm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "5.11"
      },
      {
        "_id": null,
        "model": "fujitsu m10-4s server xcp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2230"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "23.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.212"
      },
      {
        "_id": null,
        "model": "web server 02-00-/a",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "cosminexus http server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.206"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "3.5"
      },
      {
        "_id": null,
        "model": "big-ip psm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.0"
      },
      {
        "_id": null,
        "model": "web server windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-00"
      },
      {
        "_id": null,
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "_id": null,
        "model": "hp850 (comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)0"
      },
      {
        "_id": null,
        "model": "abyp-2t-2s-0l-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.2"
      },
      {
        "_id": null,
        "model": "ucosminexus developer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "abyp-4ts-p",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "17.0.963.83"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.22"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.0.34"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.5"
      },
      {
        "_id": null,
        "model": "cosminexus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "cosminexus http server linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.24"
      },
      {
        "_id": null,
        "model": "big-ip analytics hf2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "11.0.696.43"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.0.3"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.26"
      },
      {
        "_id": null,
        "model": "software opera web browser win32 beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "7.02"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "_id": null,
        "model": "ucosminexus developer hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.221"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "23.0.1271.64"
      },
      {
        "_id": null,
        "model": "web server 01-02-/d (solari",
        "scope": null,
        "trust": 0.3,
        "vendor": "hitachi",
        "version": null
      },
      {
        "_id": null,
        "model": "jboss application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7.1.1"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.307"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.22.1"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.16"
      },
      {
        "_id": null,
        "model": "big-ip apm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.1"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.12"
      },
      {
        "_id": null,
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "jg590aae hp imc bsc wlan mgr sw pltfm ap e-ltu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "500"
      },
      {
        "_id": null,
        "model": "firefox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "21.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.552.21"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "18.0.1025.142"
      },
      {
        "_id": null,
        "model": "software opera web browser win32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0.2"
      },
      {
        "_id": null,
        "model": "web server (linux ap8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "02-00(*2)"
      },
      {
        "_id": null,
        "model": "jf288aae hp network director to intelligent management center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "_id": null,
        "model": "big-ip apm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.1.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.31"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "cosminexus http server linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00-10"
      },
      {
        "_id": null,
        "model": "big-ip wom",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "firefox esr",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.3"
      },
      {
        "_id": null,
        "model": "software opera web browser linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "5.0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "23.0.1271.91"
      },
      {
        "_id": null,
        "model": "software opera web browser beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.201"
      },
      {
        "_id": null,
        "model": "big-iq cloud",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.3"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "big-ip wom hf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.1"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "seamonkey",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.16.1"
      },
      {
        "_id": null,
        "model": "big-iq security",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.2"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "ucosminexus application server standard-r",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "9.21"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "8.0.550.0"
      },
      {
        "_id": null,
        "model": "ucosminexus service platform windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "09-00(x64)"
      },
      {
        "_id": null,
        "model": "software opera web browser linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "6.0.2"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "22.0.1229.94"
      },
      {
        "_id": null,
        "model": "web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "04-10"
      },
      {
        "_id": null,
        "model": "big-ip gtm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.35"
      },
      {
        "_id": null,
        "model": "(comware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "59407)0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1.1.14"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "22.0.1229.92"
      },
      {
        "_id": null,
        "model": "big-ip ltm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "10.2.4"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10.61"
      },
      {
        "_id": null,
        "model": "big-ip asm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.0.00"
      },
      {
        "_id": null,
        "model": "software opera web browser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opera",
        "version": "10"
      },
      {
        "_id": null,
        "model": "internet explorer sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.5"
      },
      {
        "_id": null,
        "model": "big-ip gtm hf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.41"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "7.0.517.44"
      },
      {
        "_id": null,
        "model": "big-ip psm hf5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.2.1"
      },
      {
        "_id": null,
        "model": "internet explorer for windows nt",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "5.0.14.0"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.0.2.25"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.4.1"
      },
      {
        "_id": null,
        "model": "big-ip pem hf4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3.0"
      },
      {
        "_id": null,
        "model": "abyp-2t-0s-2l-p-m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "10.0.648.205"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "11.3"
      },
      {
        "_id": null,
        "model": "chrome",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "5.0.37586"
      },
      {
        "_id": null,
        "model": "safari for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "4"
      },
      {
        "_id": null,
        "model": "websphere application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.4"
      },
      {
        "_id": null,
        "model": "smb1910 (comware r1108",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "5)"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "58796"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2566"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Mitsubishi Electric reported these vulnerabilities to CISA.",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2013-2566",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2013-2566",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.1,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-62568",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.2,
            "id": "CVE-2013-2566",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2013-2566",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201303-335",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-62568",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2013-2566",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62568"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2566"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2566"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext. The RC4 algorithm, as used in SSL/TLS, is prone to a security weakness that may    allow attackers to recover plain-text. \nSuccessfully exploiting this issue in conjunction with other latent vulnerabilities may allow attackers to gain access to sensitive information that may aid in further attacks. \nHewlett-Packard Company shall not be liable for technical or editorial errors\nor omissions contained herein. \n  - HPE iMC PLAT - Please refer to the RESOLUTION\n below for a list of impacted products. All product versions are impacted\nprior to the fixed version listed. \n\n  + **iMC PLAT - Version: IMC PLAT 7.2, E0403P10**\n\n      - JD125A  HP IMC Std S/W Platform w/100-node\n      - JD126A  HP IMC Ent S/W Platform w/100-node\n      - JD808A  HP IMC Ent Platform w/100-node License\n      - JD814A   HP A-IMC Enterprise Edition Software DVD Media\n      - JD815A  HP IMC Std Platform w/100-node License\n      - JD816A  HP A-IMC Standard Edition Software DVD Media\n      - JF288AAE  HP Network Director to Intelligent Management Center\nUpgrade E-LTU\n      - JF289AAE  HP Enterprise Management System to Intelligent Management\nCenter Upgrade E-LTU\n      - JF377A  HP IMC Std S/W Platform w/100-node Lic\n      - JF377AAE  HP IMC Std S/W Pltfrm w/100-node E-LTU\n      - JF378A  HP IMC Ent S/W Platform w/200-node Lic\n      - JF378AAE  HP IMC Ent S/W Pltfrm w/200-node E-LTU\n      - JG546AAE  HP IMC Basic SW Platform w/50-node E-LTU\n      - JG548AAE  HP PCM+ to IMC Bsc Upgr w/50-node E-LTU\n      - JG549AAE  HP PCM+ to IMC Std Upgr w/200-node E-LTU\n      - JG747AAE  HP IMC Std SW Plat w/ 50 Nodes E-LTU\n      - JG748AAE  HP IMC Ent SW Plat w/ 50 Nodes E-LTU\n      - JG550AAE HPE PCM+ Mobility Manager to IMC Basic WLAN Platform Upgrade\n50-node and 150-AP E-LTU\n      - JG590AAE HPE IMC Basic WLAN Manager Software Platform 50 Access Point\nE-LTU\n      - JG660AAE HP IMC Smart Connect with Wireless Manager Virtual Appliance\nEdition E-LTU\n      - JG766AAE HP IMC Smart Connect Virtual Appliance Edition E-LTU\n      - JG767AAE HP IMC Smart Connect with Wireless Manager Virtual Appliance\nEdition E-LTU\n      - JG768AAE HPE PCM+ to IMC Standard Software Platform Upgrade with\n200-node E-LTU\n\n**Note:** Please contact HPE Technical Support if any assistance is needed\nacquiring the software updates. \n\nHISTORY\nVersion:1 (rev.1) - 26 September 2016 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05336888\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c05336888\nVersion: 1\n\nHPSBHF03673 rev.1 - HPE Comware 5 and Comware 7 Network Products using\nSSL/TLS, Multiple Remote Vulnerabilities\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2016-11-18\nLast Updated: 2016-11-18\n\nPotential Security Impact: Remote: Multiple Vulnerabilities\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nSecurity vulnerabilities in MD5 message digest algorithm and RC4 ciphersuite\ncould potentially impact HPE Comware 5 and Comware 7 network products using\nSSL/TLS. These vulnerabilities could be exploited remotely to conduct\nspoofing attacks and plaintext recovery attacks resulting in disclosure of\ninformation. \n\nReferences:\n\n  - CVE-2004-2761 - MD5 Hash Collision Vulnerability\n  - CVE-2013-2566 - SSL/TLS RC4 algorithm vulnerability\n  - CVE-2015-2808 - SSL/TLS RC4 stream vulnerability known as \"Bar Mitzvah\"\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \n\n  - Comware 5 (CW5) Products All versions\n  - Comware 7 (CW7) Products All versions\n\nBACKGROUND\n\n  CVSS Base Metrics\n  =================\n  Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector\n\n    CVE-2004-2761\n      5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\n      5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)\n\n    CVE-2013-2566\n      5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n      4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)\n\n    CVE-2015-2808\n      5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n      4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)\n\n    Information on CVSS is documented in\n    HPE Customer Notice HPSN-2008-002 here:\n\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499\n\nRESOLUTION\n\nHPE has released the following mitigation information to resolve the\nvulnerabilities in HPE Comware 5 and Comware 7 network products. \n\n  *Note:* Please contact HPE Technical Support for any assistance configuring\nthe recommended settings. \n\n**Mitigation for the hash collision vulnerability in the MD5 Algorithm:**\n\n  + For Comware V7, this issue only exists when the key-type is RSA and the\npublic key length less than 1024 bits. \n    Since the default length of the RSA key is 1024 bits, the length should\nonly have to be set manually if necessary. \n    \n      Example command to set the RSA key length to 1024 bits:\n      \n          public-key rsa general name xxx length 1024\n    \n  + For Comware V5, this issue only exists when the key-type is RSA. \n    HPE recommends using DSA and ECDSA keys and not an RSA key. \n\n**Mitigation for the RC4 vulnerabilities:**\n  \n  HPE recommends disabling RC2 and RC4 ciphers. \n  \n  + For Comware V7, remove the RC2/RC4 ciphers:\n        \n    - exp_rsa_rc2_md5\n    - exp_rsa_rc4_md5\n    - rsa_rc4_128_md5\n    - rsa_rc4_128_sha\n\n          Example using the *ssl server-policy anamea ciphersuite* command to\nomit the RC2/RC4 ciphers:\n        \n            ssl server-policy anamea ciphersuite { dhe_rsa_aes_128_cbc_sha |\ndhe_rsa_aes_256_cbc_sha | exp_rsa_des_cbc_sha | rsa_3des_ede_cbc_sha |\nrsa_aes_128_cbc_sha | rsa_aes_256_cbc_sha | rsa_des_cbc_sha }\n\n          Example using the *ssl client-policy anamea prefer-cipher* command\nto omit the RC2/RC4 ciphers:  \n\n            ssl client-policy anamea prefer-cipher { dhe_rsa_aes_128_cbc_sha\n| dhe_rsa_aes_256_cbc_sha | exp_rsa_des_cbc_sha | rsa_3des_ede_cbc_sha |\nrsa_aes_128_cbc_sha | rsa_aes_256_cbc_sha | rsa_des_cbc_sha }\n\n\n  + For Comware V5, remove the following RC4 ciphers:\n        \n    - rsa_rc4_128_md5\n    - rsa_rc4_128_sha\n\n          Example using the *ssl server-policy anamea ciphersuite* command to\nomit the RC4 ciphers:\n        \n            ssl server-policy anamea ciphersuite { rsa_3des_ede_cbc_sha |\nrsa_aes_128_cbc_sha | rsa_aes_256_cbc_sha| rsa_des_cbc_sha }\n\n          Example using the *ssl client-policy anamea prefer-cipher* command\nto omit the RC4 ciphers:  \n\n            ssl client-policy anamea prefer-cipher { rsa_3des_ede_cbc_sha |\nrsa_aes_128_cbc_sha |rsa_aes_256_cbc_sha | rsa_des_cbc_sha }\n\n\n**COMWARE 5 Products**\n\n  + **HSR6602 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JC176A HP 6602 Router Chassis\n      - JG353A HP HSR6602-G Router\n      - JG354A HP HSR6602-XG Router\n      - JG355A HP 6600 MCP-X1 Router Main Processing Unit\n      - JG356A HP 6600 MCP-X2 Router Main Processing Unit\n      - JG776A HP HSR6602-G TAA-compliant Router\n      - JG777A HP HSR6602-XG TAA-compliant Router\n      - JG778A HP 6600 MCP-X2 Router TAA-compliant Main Processing Unit\n  + **HSR6800 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG361A HP HSR6802 Router Chassis\n      - JG361B HP HSR6802 Router Chassis\n      - JG362A HP HSR6804 Router Chassis\n      - JG362B HP HSR6804 Router Chassis\n      - JG363A HP HSR6808 Router Chassis\n      - JG363B HP HSR6808 Router Chassis\n      - JG364A HP HSR6800 RSE-X2 Router Main Processing Unit\n      - JG779A HP HSR6800 RSE-X2 Router TAA-compliant Main Processing Unit\n  + **MSR20 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD432A HP A-MSR20-21 Router\n      - JD662A HP MSR20-20 Router\n      - JD663A HP A-MSR20-21 Router\n      - JD663B HP MSR20-21 Router\n      - JD664A HP MSR20-40 Router\n      - JF228A HP MSR20-40 Router\n      - JF283A HP MSR20-20 Router\n  + **MSR20-1X  (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD431A HP MSR20-10 Router\n      - JD667A HP MSR20-15 IW Multi-Service Router\n      - JD668A HP MSR20-13 Multi-Service Router\n      - JD669A HP MSR20-13 W Multi-Service Router\n      - JD670A HP MSR20-15 A Multi-Service Router\n      - JD671A HP MSR20-15 AW Multi-Service Router\n      - JD672A HP MSR20-15 I Multi-Service Router\n      - JD673A HP MSR20-11 Multi-Service Router\n      - JD674A HP MSR20-12 Multi-Service Router\n      - JD675A HP MSR20-12 W Multi-Service Router\n      - JD676A HP MSR20-12 T1 Multi-Service Router\n      - JF236A HP MSR20-15-I Router\n      - JF237A HP MSR20-15-A Router\n      - JF238A HP MSR20-15-I-W Router\n      - JF239A HP MSR20-11 Router\n      - JF240A HP MSR20-13 Router\n      - JF241A HP MSR20-12 Router\n      - JF806A HP MSR20-12-T Router\n      - JF807A HP MSR20-12-W Router\n      - JF808A HP MSR20-13-W Router\n      - JF809A HP MSR20-15-A-W Router\n      - JF817A HP MSR20-15 Router\n      - JG209A HP MSR20-12-T-W Router (NA)\n      - JG210A HP MSR20-13-W Router (NA)\n  + **MSR 30 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD654A HP MSR30-60 POE Multi-Service Router\n      - JD657A HP MSR30-40 Multi-Service Router\n      - JD658A HP MSR30-60 Multi-Service Router\n      - JD660A HP MSR30-20 POE Multi-Service Router\n      - JD661A HP MSR30-40 POE Multi-Service Router\n      - JD666A HP MSR30-20 Multi-Service Router\n      - JF229A HP MSR30-40 Router\n      - JF230A HP MSR30-60 Router\n      - JF232A HP RTMSR3040-AC-OVSAS-H3\n      - JF235A HP MSR30-20 DC Router\n      - JF284A HP MSR30-20 Router\n      - JF287A HP MSR30-40 DC Router\n      - JF801A HP MSR30-60 DC Router\n      - JF802A HP MSR30-20 PoE Router\n      - JF803A HP MSR30-40 PoE Router\n      - JF804A HP MSR30-60 PoE Router\n      - JG728A HP MSR30-20 TAA-compliant DC Router\n      - JG729A HP MSR30-20 TAA-compliant Router\n  + **MSR 30-16 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD659A HP MSR30-16 POE Multi-Service Router\n      - JD665A HP MSR30-16 Multi-Service Router\n      - JF233A HP MSR30-16 Router\n      - JF234A HP MSR30-16 PoE Router\n  + **MSR 30-1X (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JF800A HP MSR30-11 Router\n      - JF816A HP MSR30-10 2 FE /2 SIC /1 MIM MS Rtr\n      - JG182A HP MSR30-11E Router\n      - JG183A HP MSR30-11F Router\n      - JG184A HP MSR30-10 DC Router\n  + **MSR 50 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD433A HP MSR50-40 Router\n      - JD653A HP MSR50 Processor Module\n      - JD655A HP MSR50-40 Multi-Service Router\n      - JD656A HP MSR50-60 Multi-Service Router\n      - JF231A HP MSR50-60 Router\n      - JF285A HP MSR50-40 DC Router\n      - JF640A HP MSR50-60 Rtr Chassis w DC PwrSupply\n  + **MSR 50-G2 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD429A HP MSR50 G2 Processor Module\n      - JD429B HP MSR50 G2 Processor Module\n  + **MSR 9XX (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JF812A HP MSR900 Router\n      - JF813A HP MSR920 Router\n      - JF814A HP MSR900-W Router\n      - JF815A HP MSR920 2FEWAN/8FELAN/.11 b/g Rtr\n      - JG207A HP MSR900-W Router (NA)\n      - JG208A HP MSR920-W Router (NA)\n  + **MSR 93X (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG511A HP MSR930 Router\n      - JG511B HP MSR930 Router\n      - JG512A HP MSR930 Wireless Router\n      - JG513A HP MSR930 3G Router\n      - JG513B HP MSR930 3G Router\n      - JG514A HP MSR931 Router\n      - JG514B HP MSR931 Router\n      - JG515A HP MSR931 3G Router\n      - JG516A HP MSR933 Router\n      - JG517A HP MSR933 3G Router\n      - JG518A HP MSR935 Router\n      - JG518B HP MSR935 Router\n      - JG519A HP MSR935 Wireless Router\n      - JG520A HP MSR935 3G Router\n      - JG531A HP MSR931 Dual 3G Router\n      - JG531B HP MSR931 Dual 3G Router\n      - JG596A HP MSR930 4G LTE/3G CDMA Router\n      - JG597A HP MSR936 Wireless Router\n      - JG665A HP MSR930 4G LTE/3G WCDMA Global Router\n      - JG704A HP MSR930 4G LTE/3G WCDMA  ATT Router\n      - JH009A HP MSR931 Serial (TI) Router\n      - JH010A HP MSR933 G.SHDSL (TI) Router\n      - JH011A HP MSR935 ADSL2+ (TI) Router\n      - JH012A HP MSR930 Wireless 802.11n (NA) Router\n      - JH012B HP MSR930 Wireless 802.11n (NA) Router\n      - JH013A HP MSR935 Wireless 802.11n (NA) Router\n  + **MSR1000 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG732A HP MSR1003-8 AC Router\n  + **12500 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JC072B HP 12500 Main Processing Unit\n      - JC085A HP A12518 Switch Chassis\n      - JC086A HP A12508 Switch Chassis\n      - JC652A HP 12508 DC Switch Chassis\n      - JC653A HP 12518 DC Switch Chassis\n      - JC654A HP 12504 AC Switch Chassis\n      - JC655A HP 12504 DC Switch Chassis\n      - JC808A HP 12500 TAA Main Processing Unit\n      - JF430A HP A12518 Switch Chassis\n      - JF430B HP 12518 Switch Chassis\n      - JF430C HP 12518 AC Switch Chassis\n      - JF431A HP A12508 Switch Chassis\n      - JF431B HP 12508 Switch Chassis\n      - JF431C HP 12508 AC Switch Chassis\n  + **9500E (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JC124A HP A9508 Switch Chassis\n      - JC124B HP 9505 Switch Chassis\n      - JC125A HP A9512 Switch Chassis\n      - JC125B HP 9512 Switch Chassis\n      - JC474A HP A9508-V Switch Chassis\n      - JC474B HP 9508-V Switch Chassis\n  + **10500 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JC611A HP 10508-V Switch Chassis\n      - JC612A HP 10508 Switch Chassis\n      - JC613A HP 10504 Switch Chassis\n      - JC614A HP 10500 Main Processing Unit\n      - JC748A HP 10512 Switch Chassis\n      - JG375A HP 10500 TAA-compliant Main Processing Unit\n      - JG820A HP 10504 TAA-compliant Switch Chassis\n      - JG821A HP 10508 TAA-compliant Switch Chassis\n      - JG822A HP 10508-V TAA-compliant Switch Chassis\n      - JG823A HP 10512 TAA-compliant Switch Chassis\n  + **7500 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JC666A HP 7503-S 144Gbps Fabric/MPU with PoE Upgradable 20-port\nGig-T/4-port GbE Combo\n      - JC697A HP 7502 TAA-compliant Main Processing Unit\n      - JC698A HP 7503-S 144Gbps TAA Fabric / MPU with 16 GbE SFP Ports and 8\nGbE Combo Ports\n      - JC699A HP 7500 384Gbps TAA-compliant Fabric / MPU with 2 10GbE XFP\nPorts\n      - JC700A HP 7500 384Gbps TAA-compliant Fabric / Main Processing Unit\n      - JC701A HP 7500 768Gbps TAA-compliant Fabric / Main Processing Unit\n      - JD193A HP 7500 384Gbps Fabric Module with 2 XFP Ports\n      - JD193B HP 7500 384Gbps Fabric Module with 2 XFP Ports\n      - JD194A HP 7500 384Gbps Fabric Module\n      - JD194B HP 7500 384Gbps Fabric Module\n      - JD195A HP 7500 384Gbps Advanced Fabric Module\n      - JD196A HP 7502 Fabric Module\n      - JD220A HP 7500 768Gbps Fabric Module\n      - JD224A HP 7500 384Gbps Fabric Module with 12 SFP Ports\n      - JD238A HP 7510 Switch Chassis\n      - JD238B HP 7510 Switch Chassis\n      - JD239A HP 7506 Switch Chassis\n      - JD239B HP 7506 Switch Chassis\n      - JD240A HP 7503 Switch Chassis\n      - JD240B HP 7503 Switch Chassis\n      - JD241A HP 7506-V Switch Chassis\n      - JD241B HP 7506-V Switch Chassis\n      - JD242A HP 7502 Switch Chassis\n      - JD242B HP 7502 Switch Chassis\n      - JD243A HP 7503-S Switch Chassis with 1 Fabric Slot\n      - JD243B HP 7503-S Switch Chassis with 1 Fabric Slot\n      - JE164A HP E7902 Switch Chassis\n      - JE165A HP E7903 Switch Chassis\n      - JE166A HP E7903 1 Fabric Slot Switch Chassis\n      - JE167A HP E7906 Switch Chassis\n      - JE168A HP E7906 Vertical Switch Chassis\n      - JE169A HP E7910 Switch Chassis\n  + **6125G/XG Blade Switch - Version: See Mitigation**\n    * HP Network Products\n      - 737220-B21 HP 6125G Blade Switch with TAA\n      - 737226-B21 HP 6125G/XG Blade Switch with TAA\n      - 658250-B21 HP 6125G/XG Blade Switch Opt Kit\n      - 658247-B21 HP 6125G Blade Switch Opt Kit\n  + **5830 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JC691A HP 5830AF-48G Switch with 1 Interface Slot\n      - JC694A HP 5830AF-96G Switch\n      - JG316A HP 5830AF-48G TAA-compliant Switch w/1 Interface Slot\n      - JG374A HP 5830AF-96G TAA-compliant Switch\n  + **5800 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JC099A HP 5800-24G-PoE Switch\n      - JC099B HP 5800-24G-PoE+ Switch\n      - JC100A HP 5800-24G Switch\n      - JC100B HP 5800-24G Switch\n      - JC101A HP 5800-48G Switch with 2 Slots\n      - JC101B HP 5800-48G-PoE+ Switch with 2 Interface Slots\n      - JC103A HP 5800-24G-SFP Switch\n      - JC103B HP 5800-24G-SFP Switch with 1 Interface Slot\n      - JC104A HP 5800-48G-PoE Switch\n      - JC104B HP 5800-48G-PoE+ Switch with 1 Interface Slot\n      - JC105A HP 5800-48G Switch\n      - JC105B HP 5800-48G Switch with 1 Interface Slot\n      - JG254A HP 5800-24G-PoE+ TAA-compliant Switch\n      - JG254B HP 5800-24G-PoE+ TAA-compliant Switch\n      - JG255A HP 5800-24G TAA-compliant Switch\n      - JG255B HP 5800-24G TAA-compliant Switch\n      - JG256A HP 5800-24G-SFP TAA-compliant Switch with 1 Interface Slot\n      - JG256B HP 5800-24G-SFP TAA-compliant Switch with 1 Interface Slot\n      - JG257A HP 5800-48G-PoE+ TAA-compliant Switch with 1 Interface Slot\n      - JG257B HP 5800-48G-PoE+ TAA-compliant Switch with 1 Interface Slot\n      - JG258A HP 5800-48G TAA-compliant Switch with 1 Interface Slot\n      - JG258B HP 5800-48G TAA-compliant Switch with 1 Interface Slot\n      - JG225A HP 5800AF-48G Switch\n      - JG225B HP 5800AF-48G Switch\n      - JG242A HP 5800-48G-PoE+ TAA-compliant Switch with 2 Interface Slots\n      - JG242B HP 5800-48G-PoE+ TAA-compliant Switch with 2 Interface\n      - JG243A HP 5820-24XG-SFP+ TAA-compliant Switch\n      - JG243B HP 5820-24XG-SFP+ TAA-compliant Switch\n      - JG259A HP 5820X-14XG-SFP+ TAA-compliant Switch with 2 Interface Slots\n\u0026 1 OAA Slot\n      - JG259B HP 5820-14XG-SFP+ TAA-compliant Switch with 2 Interface Slots\nand 1 OAA Slot\n      - JC106A HP 5820-14XG-SFP+ Switch with 2 Slots\n      - JC106B HP 5820-14XG-SFP+ Switch with 2 Interface Slots \u0026 1 OAA Slot\n      - JG219A HP 5820AF-24XG Switch\n      - JG219B HP 5820AF-24XG Switch\n      - JC102A HP 5820-24XG-SFP+ Switch\n      - JC102B HP 5820-24XG-SFP+ Switch\n  + **5500 HI (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG311A HP 5500-24G-4SFP HI Switch with 2 Interface Slots\n      - JG312A HP 5500-48G-4SFP HI Switch with 2 Interface Slots\n      - JG541A HP 5500-24G-PoE+-4SFP HI Switch with 2 Interface Slots\n      - JG542A HP 5500-48G-PoE+-4SFP HI Switch with 2 Interface Slots\n      - JG543A HP 5500-24G-SFP HI Switch with 2 Interface Slots\n      - JG679A HP 5500-24G-PoE+-4SFP HI TAA-compliant Switch with 2 Interface\nSlots\n      - JG680A HP 5500-48G-PoE+-4SFP HI TAA-compliant Switch with 2 Interface\nSlots\n      - JG681A HP 5500-24G-SFP HI TAA-compliant Switch with 2 Interface Slots\n  + **5500 EI (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD373A HP 5500-24G DC EI Switch\n      - JD374A HP 5500-24G-SFP EI Switch\n      - JD375A HP 5500-48G EI Switch\n      - JD376A HP 5500-48G-PoE EI Switch\n      - JD377A HP 5500-24G EI Switch\n      - JD378A HP 5500-24G-PoE EI Switch\n      - JD379A HP 5500-24G-SFP DC EI Switch\n      - JG240A HP 5500-48G-PoE+ EI Switch with 2 Interface Slots\n      - JG241A HP 5500-24G-PoE+ EI Switch with 2 Interface Slots\n      - JG249A HP 5500-24G-SFP EI TAA-compliant Switch with 2 Interface\n      - JG250A HP 5500-24G EI TAA-compliant Switch with 2 Interface Slots\n      - JG251A HP 5500-48G EI TAA-compliant Switch with 2 Interface Slots\n      - JG252A HP 5500-24G-PoE+ EI TAA-compliant Switch with 2 Interface\nSlots\n      - JG253A HP 5500-48G-PoE+ EI TAA-compliant Switch with 2 Interface\nSlots\n  + **4800G (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD007A HP 4800-24G Switch\n      - JD008A HP 4800-24G-PoE Switch\n      - JD009A HP 4800-24G-SFP Switch\n      - JD010A HP 4800-48G Switch\n      - JD011A HP 4800-48G-PoE Switch\n  + **5500SI (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD369A HP 5500-24G SI Switch\n      - JD370A HP 5500-48G SI Switch\n      - JD371A HP 5500-24G-PoE SI Switch\n      - JD372A HP 5500-48G-PoE SI Switch\n      - JG238A HP 5500-24G-PoE+ SI Switch with 2 Interface Slots\n      - JG239A HP 5500-48G-PoE+ SI Switch with 2 Interface Slots\n  + **4500G (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JF428A HP 4510-48G Switch\n      - JF847A HP 4510-24G Switch\n  + **5120 EI (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JE066A HP 5120-24G EI Switch\n      - JE067A HP 5120-48G EI Switch\n      - JE068A HP 5120-24G EI Switch with 2 Interface Slots\n      - JE069A HP 5120-48G EI Switch with 2 Interface Slots\n      - JE070A HP 5120-24G-PoE EI 2-slot Switch\n      - JE071A HP 5120-48G-PoE EI 2-slot Switch\n      - JG236A HP 5120-24G-PoE+ EI Switch with 2 Interface Slots\n      - JG237A HP 5120-48G-PoE+ EI Switch with 2 Interface Slots\n      - JG245A HP 5120-24G EI TAA-compliant Switch with 2 Interface Slots\n      - JG246A HP 5120-48G EI TAA-compliant Switch with 2 Interface Slots\n      - JG247A HP 5120-24G-PoE+ EI TAA-compliant Switch with 2 Slots\n      - JG248A HP 5120-48G-PoE+ EI TAA-compliant Switch with 2 Slots\n  + **4210G (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JF844A HP 4210-24G Switch\n      - JF845A HP 4210-48G Switch\n      - JF846A HP 4210-24G-PoE Switch\n  + **5120 SI (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JE072A HP 5120-48G SI Switch\n      - JE072B HPE 5120 48G SI Switch\n      - JE073A HP 5120-16G SI Switch\n      - JE073B HPE 5120 16G SI Switch\n      - JE074A HP 5120-24G SI Switch\n      - JE074B HPE 5120 24G SI Switch\n      - JG091A HP 5120-24G-PoE+ (370W) SI Switch\n      - JG091B HPE 5120 24G PoE+ (370W) SI Switch\n      - JG092A HP 5120-24G-PoE+ (170W) SI Switch\n      - JG309B HPE 5120 8G PoE+ (180W) SI Switch\n      - JG310B HPE 5120 8G PoE+ (65W) SI Switch\n  + **3610 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD335A HP 3610-48 Switch\n      - JD336A HP 3610-24-4G-SFP Switch\n      - JD337A HP 3610-24-2G-2G-SFP Switch\n      - JD338A HP 3610-24-SFP Switch\n  + **3600V2 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG299A HP 3600-24 v2 EI Switch\n      - JG299B HP 3600-24 v2 EI Switch\n      - JG300A HP 3600-48 v2 EI Switch\n      - JG300B HP 3600-48 v2 EI Switch\n      - JG301A HP 3600-24-PoE+ v2 EI Switch\n      - JG301B HP 3600-24-PoE+ v2 EI Switch\n      - JG301C HP 3600-24-PoE+ v2 EI Switch\n      - JG302A HP 3600-48-PoE+ v2 EI Switch\n      - JG302B HP 3600-48-PoE+ v2 EI Switch\n      - JG302C HP 3600-48-PoE+ v2 EI Switch\n      - JG303A HP 3600-24-SFP v2 EI Switch\n      - JG303B HP 3600-24-SFP v2 EI Switch\n      - JG304A HP 3600-24 v2 SI Switch\n      - JG304B HP 3600-24 v2 SI Switch\n      - JG305A HP 3600-48 v2 SI Switch\n      - JG305B HP 3600-48 v2 SI Switch\n      - JG306A HP 3600-24-PoE+ v2 SI Switch\n      - JG306B HP 3600-24-PoE+ v2 SI Switch\n      - JG306C HP 3600-24-PoE+ v2 SI Switch\n      - JG307A HP 3600-48-PoE+ v2 SI Switch\n      - JG307B HP 3600-48-PoE+ v2 SI Switch\n      - JG307C HP 3600-48-PoE+ v2 SI Switch\n  + **3100V2-48 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG315A HP 3100-48 v2 Switch\n      - JG315B HP 3100-48 v2 Switch\n  + **HP870 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG723A HP 870 Unified Wired-WLAN Appliance\n      - JG725A HP 870 Unified Wired-WLAN TAA-compliant Appliance\n  + **HP850 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG722A HP 850 Unified Wired-WLAN Appliance\n      - JG724A HP 850 Unified Wired-WLAN TAA-compliant Appliance\n  + **HP830 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG640A HP 830 24-Port PoE+ Unified Wired-WLAN Switch\n      - JG641A HP 830 8-port PoE+ Unified Wired-WLAN Switch\n      - JG646A HP 830 24-Port PoE+ Unified Wired-WLAN TAA-compliant Switch\n      - JG647A HP 830 8-Port PoE+ Unified Wired-WLAN TAA-compliant\n  + **HP6000 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG639A HP 10500/7500 20G Unified Wired-WLAN Module\n      - JG645A HP 10500/7500 20G Unified Wired-WLAN TAA-compliant Module\n  + **WX5004-EI (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD447B HP WX5002 Access Controller\n      - JD448A HP WX5004 Access Controller\n      - JD448B HP WX5004 Access Controller\n      - JD469A HP WX5004 Access Controller\n  + **SecBlade FW (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JC635A HP 12500 VPN Firewall Module\n      - JD245A HP 9500 VPN Firewall Module\n      - JD249A HP 10500/7500 Advanced VPN Firewall Module\n      - JD250A HP 6600 Firewall Processing Router Module\n      - JD251A HP 8800 Firewall Processing Module\n      - JD255A HP 5820 VPN Firewall Module\n  + **F1000-E (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD272A HP F1000-E VPN Firewall Appliance\n  + **F1000-A-EI (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG214A HP F1000-A-EI VPN Firewall Appliance\n  + **F1000-S-EI (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG213A HP F1000-S-EI VPN Firewall Appliance\n  + **F5000-A (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD259A HP A5000-A5 VPN Firewall Chassis\n      - JG215A HP F5000 Firewall Main Processing Unit\n      - JG216A HP F5000 Firewall Standalone Chassis\n  + **U200S and CS (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD273A HP U200-S UTM Appliance\n  + **U200A and M (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JD275A HP U200-A UTM Appliance\n  + **F5000-C/S (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG650A HP F5000-C VPN Firewall Appliance\n      - JG370A HP F5000-S VPN Firewall Appliance\n  + **SecBlade III (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG371A HP 12500 20Gbps VPN Firewall Module\n      - JG372A HP 10500/11900/7500 20Gbps VPN Firewall Module\n  + **6600 RSE RU (Comware 5 Low Encryption SW) - Version: See Mitigation**\n    * HP Network Products\n      - JC177A HP 6608 Router\n      - JC177B HP 6608 Router Chassis\n      - JC178A HP 6604 Router Chassis\n      - JC178B HP 6604 Router Chassis\n      - JC496A HP 6616 Router Chassis\n      - JC566A HP 6600 RSE-X1 Router Main Processing Unit\n      - JG780A HP 6600 RSE-X1 TAA-compliant Main Processing Unit\n  + **6600 RPE RU (Comware 5 Low Encryption SW) - Version: See Mitigation**\n    * HP Network Products\n      - JC165A HP 6600 RPE-X1 Router Module\n      - JG781A HP 6600 RPE-X1 TAA-compliant Main Processing Unit\n  + **6602 RU (Comware 5 Low Encryption SW) - Version: See Mitigation**\n    * HP Network Products\n      - JC176A HP 6602 Router Chassis\n  + **HSR6602 RU (Comware 5 Low Encryption SW) - Version: See Mitigation**\n    * HP Network Products\n      - JC177A HP 6608 Router\n      - JC177B HP 6608 Router Chassis\n      - JC178A HP 6604 Router Chassis\n      - JC178B HP 6604 Router Chassis\n      - JC496A HP 6616 Router Chassis\n      - JG353A HP HSR6602-G Router\n      - JG354A HP HSR6602-XG Router\n      - JG355A HP 6600 MCP-X1 Router Main Processing Unit\n      - JG356A HP 6600 MCP-X2 Router Main Processing Unit\n      - JG776A HP HSR6602-G TAA-compliant Router\n      - JG777A HP HSR6602-XG TAA-compliant Router\n      - JG778A HP 6600 MCP-X2 Router TAA-compliant Main Processing Unit\n  + **HSR6800 RU (Comware 5 Low Encryption SW) - Version: See Mitigation**\n    * HP Network Products\n      - JG361A HP HSR6802 Router Chassis\n      - JG361B HP HSR6802 Router Chassis\n      - JG362A HP HSR6804 Router Chassis\n      - JG362B HP HSR6804 Router Chassis\n      - JG363A HP HSR6808 Router Chassis\n      - JG363B HP HSR6808 Router Chassis\n      - JG364A HP HSR6800 RSE-X2 Router Main Processing Unit\n      - JG779A HP HSR6800 RSE-X2 Router TAA-compliant Main Processing Unit\n  + **SMB1910 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG540A HP 1910-48 Switch\n      - JG539A HP 1910-24-PoE+ Switch\n      - JG538A HP 1910-24 Switch\n      - JG537A HP 1910-8 -PoE+ Switch\n      - JG536A HP 1910-8 Switch\n  + **SMB1920 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG928A HP 1920-48G-PoE+ (370W) Switch\n      - JG927A HP 1920-48G Switch\n      - JG926A HP 1920-24G-PoE+ (370W) Switch\n      - JG925A HP 1920-24G-PoE+ (180W) Switch\n      - JG924A HP 1920-24G Switch\n      - JG923A HP 1920-16G Switch\n      - JG922A HP 1920-8G-PoE+ (180W) Switch\n      - JG921A HP 1920-8G-PoE+ (65W) Switch\n      - JG920A HP 1920-8G Switch\n  + **V1910 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JE005A HP 1910-16G Switch\n      - JE006A HP 1910-24G Switch\n      - JE007A HP 1910-24G-PoE (365W) Switch\n      - JE008A HP 1910-24G-PoE(170W) Switch\n      - JE009A HP 1910-48G Switch\n      - JG348A HP 1910-8G Switch\n      - JG349A HP 1910-8G-PoE+ (65W) Switch\n      - JG350A HP 1910-8G-PoE+ (180W) Switch\n  + **SMB 1620 (Comware 5) - Version: See Mitigation**\n    * HP Network Products\n      - JG914A HP 1620-48G Switch\n      - JG913A HP 1620-24G Switch\n      - JG912A HP 1620-8G Switch\n\n\n**COMWARE 7 Products**\n\n  + **12500 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JC072B HP 12500 Main Processing Unit\n      - JC085A HP A12518 Switch Chassis\n      - JC086A HP A12508 Switch Chassis\n      - JC652A HP 12508 DC Switch Chassis\n      - JC653A HP 12518 DC Switch Chassis\n      - JC654A HP 12504 AC Switch Chassis\n      - JC655A HP 12504 DC Switch Chassis\n      - JF430A HP A12518 Switch Chassis\n      - JF430B HP 12518 Switch Chassis\n      - JF430C HP 12518 AC Switch Chassis\n      - JF431A HP A12508 Switch Chassis\n      - JF431B HP 12508 Switch Chassis\n      - JF431C HP 12508 AC Switch Chassis\n      - JG497A HP 12500 MPU w/Comware V7 OS\n      - JG782A HP FF 12508E AC Switch Chassis\n      - JG783A HP FF 12508E DC Switch Chassis\n      - JG784A HP FF 12518E AC Switch Chassis\n      - JG785A HP FF 12518E DC Switch Chassis\n      - JG802A HP FF 12500E MPU\n  + **10500 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JC611A HP 10508-V Switch Chassis\n      - JC612A HP 10508 Switch Chassis\n      - JC613A HP 10504 Switch Chassis\n      - JC748A HP 10512 Switch Chassis\n      - JG608A HP FlexFabric 11908-V Switch Chassis\n      - JG609A HP FlexFabric 11900 Main Processing Unit\n      - JG820A HP 10504 TAA Switch Chassis\n      - JG821A HP 10508 TAA Switch Chassis\n      - JG822A HP 10508-V TAA Switch Chassis\n      - JG823A HP 10512 TAA Switch Chassis\n      - JG496A HP 10500 Type A MPU w/Comware v7 OS\n      - JH198A HP 10500 Type D Main Processing Unit with Comware v7 Operating\nSystem\n      - JH206A HP 10500 Type D TAA-compliant with Comware v7 Operating System\nMain Processing Unit\n  + **12900 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG619A HP FlexFabric 12910 Switch AC Chassis\n      - JG621A HP FlexFabric 12910 Main Processing Unit\n      - JG632A HP FlexFabric 12916 Switch AC Chassis\n      - JG634A HP FlexFabric 12916 Main Processing Unit\n      - JH104A HP FlexFabric 12900E Main Processing Unit\n      - JH114A HP FlexFabric 12910 TAA-compliant Main Processing Unit\n      - JH263A HP FlexFabric 12904E Main Processing Unit\n      - JH255A HP FlexFabric 12908E Switch Chassis\n      - JH262A HP FlexFabric 12904E Switch Chassis\n      - JH113A HP FlexFabric 12910 TAA-compliant Switch AC Chassis\n      - JH103A HP FlexFabric 12916E Switch Chassis\n  + **5900 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JC772A HP 5900AF-48XG-4QSFP+ Switch\n      - JG296A HP 5920AF-24XG Switch\n      - JG336A HP 5900AF-48XGT-4QSFP+ Switch\n      - JG510A HP 5900AF-48G-4XG-2QSFP+ Switch\n      - JG554A HP 5900AF-48XG-4QSFP+ TAA Switch\n      - JG555A HP 5920AF-24XG TAA Switch\n      - JG838A HP FF 5900CP-48XG-4QSFP+ Switch\n      - JH036A HP FlexFabric 5900CP 48XG 4QSFP+ TAA-Compliant\n      - JH037A HP 5900AF 48XGT 4QSFP+ TAA-Compliant Switch\n      - JH038A HP 5900AF 48G 4XG 2QSFP+ TAA-Compliant\n  + **MSR1000 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG875A HP MSR1002-4 AC Router\n      - JH060A HP MSR1003-8S AC Router\n  + **MSR2000 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG411A HP MSR2003 AC Router\n      - JG734A HP MSR2004-24 AC Router\n      - JG735A HP MSR2004-48 Router\n      - JG866A HP MSR2003 TAA-compliant AC Router\n  + **MSR3000 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG404A HP MSR3064 Router\n      - JG405A HP MSR3044 Router\n      - JG406A HP MSR3024 AC Router\n      - JG407A HP MSR3024 DC Router\n      - JG408A HP MSR3024 PoE Router\n      - JG409A HP MSR3012 AC Router\n      - JG410A HP MSR3012 DC Router\n      - JG861A HP MSR3024 TAA-compliant AC Router\n  + **MSR4000 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG402A HP MSR4080 Router Chassis\n      - JG403A HP MSR4060 Router Chassis\n      - JG412A HP MSR4000 MPU-100 Main Processing Unit\n      - JG869A HP MSR4000 TAA-compliant MPU-100 Main Processing Unit\n  + **VSR (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG810AAE HP VSR1001 Virtual Services Router 60 Day Evaluation\nSoftware\n      - JG811AAE HP VSR1001 Comware 7 Virtual Services Router\n      - JG812AAE HP VSR1004 Comware 7 Virtual Services Router\n      - JG813AAE HP VSR1008 Comware 7 Virtual Services Router\n  + **7900 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG682A HP FlexFabric 7904 Switch Chassis\n      - JG841A HP FlexFabric 7910 Switch Chassis\n      - JG842A HP FlexFabric 7910 7.2Tbps Fabric / Main Processing Unit\n      - JH001A HP FlexFabric 7910 2.4Tbps Fabric / Main Processing Unit\n      - JH122A HP FlexFabric 7904 TAA-compliant Switch Chassis\n      - JH123A HP FlexFabric 7910 TAA-compliant Switch Chassis\n      - JH124A HP FlexFabric 7910 7.2Tbps TAA-compliant Fabric/Main\nProcessing Unit\n      - JH125A HP FlexFabric 7910 2.4Tbps TAA-compliant Fabric/Main\nProcessing Unit\n  + **5130 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG932A HP 5130-24G-4SFP+ EI Switch\n      - JG933A HP 5130-24G-SFP-4SFP+ EI Switch\n      - JG934A HP 5130-48G-4SFP+ EI Switch\n      - JG936A HP 5130-24G-PoE+-4SFP+ (370W) EI Switch\n      - JG937A HP 5130-48G-PoE+-4SFP+ (370W) EI Switch\n      - JG938A HP 5130-24G-2SFP+-2XGT EI Switch\n      - JG939A HP 5130-48G-2SFP+-2XGT EI Switch\n      - JG940A HP 5130-24G-PoE+-2SFP+-2XGT (370W) EI Switch\n      - JG941A HP 5130-48G-PoE+-2SFP+-2XGT (370W) EI Switch\n      - JG975A HP 5130-24G-4SFP+ EI Brazil Switch\n      - JG976A HP 5130-48G-4SFP+ EI Brazil Switch\n      - JG977A HP 5130-24G-PoE+-4SFP+ (370W) EI Brazil Switch\n      - JG978A HP 5130-48G-PoE+-4SFP+ (370W) EI Brazil Switch\n  + **6125XLG - Version: See Mitigation**\n    * HP Network Products\n      - 711307-B21 HP 6125XLG Blade Switch\n      - 737230-B21 HP 6125XLG Blade Switch with TAA\n  + **6127XLG - Version: See Mitigation**\n    * HP Network Products\n      - 787635 HP 6127XLG Blade Switch Opt Kit\n  + **Moonshot - Version: See Mitigation**\n    * HP Network Products\n      - 786617-B21 - HP Moonshot-45Gc Switch Module\n      - 704654-B21 - HP Moonshot-45XGc Switch Module\n      - 786619-B21 - HP Moonshot-180XGc Switch Module\n  + **5700 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG894A HP FlexFabric 5700-48G-4XG-2QSFP+ Switch\n      - JG895A HP FlexFabric 5700-48G-4XG-2QSFP+ TAA-compliant Switch\n      - JG896A HP FlexFabric 5700-40XG-2QSFP+ Switch\n      - JG897A HP FlexFabric 5700-40XG-2QSFP+ TAA-compliant Switch\n      - JG898A HP FlexFabric 5700-32XGT-8XG-2QSFP+ Switch\n      - JG899A HP FlexFabric 5700-32XGT-8XG-2QSFP+ TAA-compliant Switch\n  + **5930 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG726A HP FlexFabric 5930 32QSFP+ Switch\n      - JG727A HP FlexFabric 5930 32QSFP+ TAA-compliant Switch\n      - JH178A HP FlexFabric 5930 2QSFP+ 2-slot Switch\n      - JH179A HP FlexFabric 5930 4-slot Switch\n      - JH187A HP FlexFabric 5930 2QSFP+ 2-slot TAA-compliant Switch\n      - JH188A HP FlexFabric 5930 4-slot TAA-compliant Switch\n  + **HSR6600 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG353A HP HSR6602-G Router\n      - JG354A HP HSR6602-XG Router\n      - JG776A HP HSR6602-G TAA-compliant Router\n      - JG777A HP HSR6602-XG TAA-compliant Router\n  + **HSR6800 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG361A HP HSR6802 Router Chassis\n      - JG361B HP HSR6802 Router Chassis\n      - JG362A HP HSR6804 Router Chassis\n      - JG362B HP HSR6804 Router Chassis\n      - JG363A HP HSR6808 Router Chassis\n      - JG363B HP HSR6808 Router Chassis\n      - JG364A HP HSR6800 RSE-X2 Router Main Processing Unit\n      - JG779A HP HSR6800 RSE-X2 Router TAA-compliant Main Processing\n      - JH075A HP HSR6800 RSE-X3 Router Main Processing Unit\n  + **1950 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JG960A HP 1950-24G-4XG Switch\n      - JG961A HP 1950-48G-2SFP+-2XGT Switch\n      - JG962A HP 1950-24G-2SFP+-2XGT-PoE+(370W) Switch\n      - JG963A HP 1950-48G-2SFP+-2XGT-PoE+(370W) Switch\n  + **7500 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JD238C HP 7510 Switch Chassis\n      - JD239C HP 7506 Switch Chassis\n      - JD240C HP 7503 Switch Chassis\n      - JD242C HP 7502 Switch Chassis\n      - JH207A HP 7500 1.2Tbps Fabric with 2-port 40GbE QSFP+ for IRF-Only\nMain Processing Unit\n      - JH208A HP 7502 Main Processing Unit\n      - JH209A HP 7500 2.4Tbps Fabric with 8-port 1/10GbE SFP+ and 2-port\n40GbE QSFP+ Main Processing Unit\n  + **5950 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JH321A HPE FlexFabric 5950 32QSFP28 Switch\n  + **5940 (Comware 7) - Version: See Mitigation**\n    * HP Network Products\n      - JH390A HPE FlexFabric 5940 48SFP+ 6QSFP28 Switch\n      - JH391A HPE FlexFabric 5940 48XGT 6QSFP28 Switch\n      - JH394A HPE FlexFabric 5940 48XGT 6QSFP+ Switch\n      - JH395A HPE FlexFabric 5940 48SFP+ 6QSFP+ Switch\n      - JH396A HPE FlexFabric 5940 32QSFP+ Switch\n      - JH397A HPE FlexFabric 5940 2-slot Switch\n      - JH398A HPE FlexFabric 5940 4-slot Switch\n\nHISTORY\nVersion:1 (rev.1) - 18 November 2016 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability for any HPE supported\nproduct:\n  Web form: https://www.hpe.com/info/report-security-vulnerability\n  Email: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQEcBAEBCAAGBQJYLytTAAoJELXhAxt7SZaiMjYIAI4xgRNJCPqOZ40XLUNhxYrc\nHyqTd62PbcGOPTFya1qOo16V94eJ5id5oRHOtcrFjJKtDedDS6OoAe5HWYXvLEI3\n0fEzCNjk9aHTcvuf2t17MGhS0Fk2JrZ0191RFONKuEkqgMmK0d44SGMrVXSA28Dj\nphW1dzm1HiJO0NPUOa+cYMhNt0+I7b+ulD6FdldNdqx4fNtlXiHvcRbF4Wffe2hD\nN2hlvx1Wu1iu2g75XPNPOPYhDRkyAm79P2HZGCUohQlhWsRgcJRnubojJBr7CMf9\n2Ud7MwYL4jTKK/mFdim4ej/hwPn3SCb5ekhTUBFDlu2J2DjUYi2xDQgyQkhuUIg=\n=NGQO\n-----END PGP SIGNATURE-----\n. \n\nBackground\n==========\n\nMozilla Firefox is an open-source web browser and Mozilla Thunderbird\nan open-source email client, both from the Mozilla Project. The\nSeaMonkey project is a community effort to deliver production-quality\nreleases of code derived from the application formerly known as the\n=E2=80=98Mozilla Application Suite=E2=80=99. Furthermore, a remote attacker may be able\nto perform Man-in-the-Middle attacks, obtain sensitive information,\nspoof the address bar, conduct clickjacking attacks, bypass security\nrestrictions and protection mechanisms,  or have other unspecified\nimpact. ============================================================================\nUbuntu Security Notice USN-2031-1\nNovember 20, 2013\n\nfirefox vulnerabilities\n============================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 13.10\n- Ubuntu 13.04\n- Ubuntu 12.10\n- Ubuntu 12.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Firefox. (CVE-2013-1741,\nCVE-2013-2566, CVE-2013-5605, CVE-2013-5607)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 13.10:\n  firefox                         25.0.1+build1-0ubuntu0.13.10.1\n\nUbuntu 13.04:\n  firefox                         25.0.1+build1-0ubuntu0.13.04.1\n\nUbuntu 12.10:\n  firefox                         25.0.1+build1-0ubuntu0.12.10.1\n\nUbuntu 12.04 LTS:\n  firefox                         25.0.1+build1-0ubuntu0.12.04.1\n\nAfter a standard system update you need to restart Firefox to make\nall the necessary changes. \n\nReferences:\n  http://www.ubuntu.com/usn/usn-2031-1\n  CVE-2013-1741, CVE-2013-2566, CVE-2013-5605, CVE-2013-5607,\n  https://launchpad.net/bugs/1251576\n\nPackage Information:\n  https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.13.10.1\n  https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.13.04.1\n  https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.12.10.1\n  https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.12.04.1\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n _______________________________________________________________________\n\n Mandriva Linux Security Advisory                         MDVSA-2013:270\n http://www.mandriva.com/en/support/security/\n _______________________________________________________________________\n\n Package : nss\n Date    : November 20, 2013\n Affected: Business Server 1.0\n _______________________________________________________________________\n\n Problem Description:\n\n Multiple security issues was identified and fixed in mozilla NSPR\n and NSS:\n \n Mozilla Network Security Services (NSS) before 3.15.2 does not ensure\n that data structures are initialized before read operations, which\n allows remote attackers to cause a denial of service or possibly have\n unspecified other impact via vectors that trigger a decryption failure\n (CVE-2013-1739). \n \n The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla\n Network Security Services (NSS) 3.15 before 3.15.3 provides an\n unexpected return value for an incompatible key-usage certificate\n when the CERTVerifyLog argument is valid, which might allow remote\n attackers to bypass intended access restrictions via a crafted\n certificate (CVE-2013-5606). \n \n Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape\n Portable Runtime (NSPR) before 4.10.2, as used in Firefox before\n 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and\n SeaMonkey before 2.22.1, allows remote attackers to cause a denial of\n service (application crash) or possibly have unspecified other impact\n via a crafted X.509 certificate, a related issue to CVE-2013-1741\n (CVE-2013-5607). \n \n The NSPR packages has been upgraded to the 4.10.2 version and the NSS\n packages has been upgraded to the 3.15.3 version which is unaffected\n by these security flaws. \n \n Additionally the rootcerts packages has been upgraded with the latest\n certdata.txt file as of 2013/11/11 from mozilla. \n _______________________________________________________________________\n\n References:\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1739\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1741\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2566\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5606\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5607\n https://developer.mozilla.org/en-US/docs/NSS/NSS_3.15.3_release_notes\n http://www.mozilla.org/security/announce/2013/mfsa2013-103.html\n https://bugs.mageia.org/show_bug.cgi?id=11669\n _______________________________________________________________________\n\n Updated Packages:\n\n Mandriva Business Server 1/X86_64:\n af301c60ddcc18b8ac42c0b4435cbad3  mbs1/x86_64/lib64nspr4-4.10.2-1.mbs1.x86_64.rpm\n a496a08623a9f89d2399d80e4fe868a7  mbs1/x86_64/lib64nspr-devel-4.10.2-1.mbs1.x86_64.rpm\n ae3456fb3d674f99aef454a60dbe282a  mbs1/x86_64/lib64nss3-3.15.3-1.mbs1.x86_64.rpm\n 9188809d70b632b2482acee08a4ddc0b  mbs1/x86_64/lib64nss-devel-3.15.3-1.mbs1.x86_64.rpm\n 532704e8d72973d2dd61fe2698f893e4  mbs1/x86_64/lib64nss-static-devel-3.15.3-1.mbs1.x86_64.rpm\n 8f4ae3f02feb8d9f9c9efc8c257035e8  mbs1/x86_64/nss-3.15.3-1.mbs1.x86_64.rpm\n 8ae40ad195e46d8a2b30621dfcef3ace  mbs1/x86_64/nss-doc-3.15.3-1.mbs1.noarch.rpm\n 59917a5345c7938ee1ac234a64a4cbfb  mbs1/x86_64/rootcerts-20131111.00-1.mbs1.x86_64.rpm\n e118b1fef3401a9aad6502d31ac38bcc  mbs1/x86_64/rootcerts-java-20131111.00-1.mbs1.x86_64.rpm \n 1cd846051eae1d454f8886ae6472da92  mbs1/SRPMS/nspr-4.10.2-1.mbs1.src.rpm\n f2b93d77bf10bb16f24803677c2a5432  mbs1/SRPMS/nss-3.15.3-1.mbs1.src.rpm\n 72294310b8fb899d0e04fe1762e77f75  mbs1/SRPMS/rootcerts-20131111.00-1.mbs1.src.rpm\n _______________________________________________________________________\n\n To upgrade automatically use MandrivaUpdate or urpmi.  The verification\n of md5 checksums and GPG signatures is performed automatically for you. \n\n All packages are signed by Mandriva for security.  You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n  http://www.mandriva.com/en/support/security/advisories/\n\n If you want to report vulnerabilities, please contact\n\n  security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID     Date       User ID\n pub  1024D/22458A98 2000-07-10 Mandriva Security Team\n  \u003csecurity*mandriva.com\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.12 (GNU/Linux)\n\niD8DBQFSjJyxmqjQ0CJFipgRAvI3AJoDX5AXeQAKdSGxDE4mtdmcrtY3JACcDJzS\n4rxtjYRyYkAzUzpzhQfi2B4=\n=dXuI\n-----END PGP SIGNATURE-----\n. \n\nBackground\n==========\n\nThe Mozilla Network Security Service is a library implementing security\nfeatures like SSL v2/v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,\nS/MIME and X.509 certificates. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  dev-libs/nss                 \u003c 3.15.3                  \u003e= 3.15.3 \n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in the Mozilla Network\nSecurity Service. Please review the CVE identifiers referenced below\nfor more details about the vulnerabilities. \n\nImpact\n======\n\nA remote attacker can cause a Denial of Service condition. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Mozilla Network Security Service users should upgrade to the latest\nversion:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=dev-libs/nss-3.15.3\"\n\nPackages which depend on this library may need to be recompiled. Tools\nsuch as revdep-rebuild may assist in identifying some of these\npackages. \n\nReferences\n==========\n\n[ 1 ] CVE-2013-1620\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1620\n[ 2 ] CVE-2013-1739\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1739\n[ 3 ] CVE-2013-1741\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1741\n[ 4 ] CVE-2013-2566\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2566\n[ 5 ] CVE-2013-5605\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-5605\n[ 6 ] CVE-2013-5606\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-5606\n[ 7 ] CVE-2013-5607\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-5607\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201406-19.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2014 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2013-2566"
      },
      {
        "db": "BID",
        "id": "58796"
      },
      {
        "db": "VULHUB",
        "id": "VHN-62568"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2566"
      },
      {
        "db": "PACKETSTORM",
        "id": "131694"
      },
      {
        "db": "PACKETSTORM",
        "id": "138866"
      },
      {
        "db": "PACKETSTORM",
        "id": "139894"
      },
      {
        "db": "PACKETSTORM",
        "id": "131314"
      },
      {
        "db": "PACKETSTORM",
        "id": "124083"
      },
      {
        "db": "PACKETSTORM",
        "id": "124122"
      },
      {
        "db": "PACKETSTORM",
        "id": "124085"
      },
      {
        "db": "PACKETSTORM",
        "id": "127174"
      }
    ],
    "trust": 2.07
  },
  "exploit_availability": {
    "_id": null,
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-62568",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62568"
      }
    ]
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2013-2566",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "58796",
        "trust": 2.1
      },
      {
        "db": "JUNIPER",
        "id": "JSA10705",
        "trust": 1.8
      },
      {
        "db": "HITACHI",
        "id": "HS13-009",
        "trust": 0.9
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335",
        "trust": 0.7
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-160-01",
        "trust": 0.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-21-075-02",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.2853",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0190",
        "trust": 0.6
      },
      {
        "db": "HITACHI",
        "id": "HS16-001",
        "trust": 0.6
      },
      {
        "db": "HITACHI",
        "id": "HS13-021",
        "trust": 0.3
      },
      {
        "db": "PACKETSTORM",
        "id": "131694",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "124083",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-62568",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2566",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "138866",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "139894",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "131314",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "124122",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "124085",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "127174",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62568"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2566"
      },
      {
        "db": "BID",
        "id": "58796"
      },
      {
        "db": "PACKETSTORM",
        "id": "131694"
      },
      {
        "db": "PACKETSTORM",
        "id": "138866"
      },
      {
        "db": "PACKETSTORM",
        "id": "139894"
      },
      {
        "db": "PACKETSTORM",
        "id": "131314"
      },
      {
        "db": "PACKETSTORM",
        "id": "124083"
      },
      {
        "db": "PACKETSTORM",
        "id": "124122"
      },
      {
        "db": "PACKETSTORM",
        "id": "124085"
      },
      {
        "db": "PACKETSTORM",
        "id": "127174"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2566"
      }
    ]
  },
  "id": "VAR-201303-0327",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62568"
      }
    ],
    "trust": 0.5217360725
  },
  "last_update_date": "2026-03-09T21:42:17.067000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "TLS/SSL protocol  RC4 Algorithm security vulnerabilities repair measures",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=107191"
      },
      {
        "title": "Ubuntu Security Notice: thunderbird vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-2032-1"
      },
      {
        "title": "Ubuntu Security Notice: firefox vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-2031-1"
      },
      {
        "title": "Mozilla: Mozilla Foundation Security Advisory 2013-103",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=2013-103"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2016",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=05aabe19d38058b7814ef5514aab4c0c"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=e2a7f287e9acc8c64ab3df71130bc64d"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - April 2016",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=122319027ae43d6d626710f1b1bb1d43"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - April 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=143b3fb255063c81571469eaa3cf0a87"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=523d3f220a64ff01dd95e064bd37566a"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - July 2016",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=3a04485ebb79f7fbc2472bf9af5ce489"
      },
      {
        "title": "ruby-qualys",
        "trust": 0.1,
        "url": "https://github.com/mikemackintosh/ruby-qualys "
      },
      {
        "title": "testssl-report",
        "trust": 0.1,
        "url": "https://github.com/tzaffi/testssl-report "
      },
      {
        "title": "HTTPSScan",
        "trust": 0.1,
        "url": "https://github.com/alexoslabs/HTTPSScan "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2013-2566"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-326",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-310",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62568"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2566"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 2.2,
        "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-103.html"
      },
      {
        "trust": 2.1,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
      },
      {
        "trust": 2.1,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
      },
      {
        "trust": 2.1,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
      },
      {
        "trust": 2.1,
        "url": "http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html"
      },
      {
        "trust": 1.9,
        "url": "http://www.securityfocus.com/bid/58796"
      },
      {
        "trust": 1.9,
        "url": "http://security.gentoo.org/glsa/glsa-201406-19.xml"
      },
      {
        "trust": 1.9,
        "url": "https://security.gentoo.org/glsa/201504-01"
      },
      {
        "trust": 1.9,
        "url": "http://www.ubuntu.com/usn/usn-2031-1"
      },
      {
        "trust": 1.9,
        "url": "http://www.ubuntu.com/usn/usn-2032-1"
      },
      {
        "trust": 1.8,
        "url": "http://my.opera.com/securitygroup/blog/2013/03/20/on-the-precariousness-of-rc4"
      },
      {
        "trust": 1.8,
        "url": "http://www.opera.com/docs/changelogs/unified/1215/"
      },
      {
        "trust": 1.8,
        "url": "http://www.opera.com/security/advisory/1046"
      },
      {
        "trust": 1.8,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"
      },
      {
        "trust": 1.8,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
      },
      {
        "trust": 1.8,
        "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05289935"
      },
      {
        "trust": 1.8,
        "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05336888"
      },
      {
        "trust": 1.8,
        "url": "http://cr.yp.to/talks/2013.03.12/slides.pdf"
      },
      {
        "trust": 1.8,
        "url": "http://www.isg.rhul.ac.uk/tls/"
      },
      {
        "trust": 1.7,
        "url": "http://marc.info/?l=bugtraq\u0026m=143039468003789\u0026w=2"
      },
      {
        "trust": 1.7,
        "url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10705"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-2566"
      },
      {
        "trust": 0.6,
        "url": "https://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs13-009/   index.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/   hitachi-sec-2019-113/index.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs16-001/   index.html"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-160-01"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-075-02"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0190/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.2853"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5607"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5605"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1741"
      },
      {
        "trust": 0.4,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05289935"
      },
      {
        "trust": 0.4,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05336888"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2013-2566"
      },
      {
        "trust": 0.3,
        "url": "https://8pecxstudios.com/?page_id=43955"
      },
      {
        "trust": 0.3,
        "url": "http://link.springer.com/chapter/10.1007%2f978-3-642-19574-7_5"
      },
      {
        "trust": 0.3,
        "url": "http://www.palemoon.org/releasenotes-ng.shtml"
      },
      {
        "trust": 0.3,
        "url": "http://lwn.net/articles/575992/"
      },
      {
        "trust": 0.3,
        "url": "http://lwn.net/articles/575993/"
      },
      {
        "trust": 0.3,
        "url": "http://lwn.net/alerts/575994/"
      },
      {
        "trust": 0.3,
        "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html"
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/bugtraq/2015/jun/att-88/esa-2015-043.txt"
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/bugtraq/2015/apr/208"
      },
      {
        "trust": 0.3,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21700012"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21958871"
      },
      {
        "trust": 0.3,
        "url": "http://support.f5.com/kb/en-us/solutions/public/14000/600/sol14638.html?ref=rss"
      },
      {
        "trust": 0.3,
        "url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs13-021/index.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs13-009/index.html"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5606"
      },
      {
        "trust": 0.2,
        "url": "http://www.hpe.com/support/security_bulletin_archive"
      },
      {
        "trust": 0.2,
        "url": "https://www.hpe.com/info/report-security-vulnerability"
      },
      {
        "trust": 0.2,
        "url": "http://www.hpe.com/support/subscriber_choice"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2004-2761"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-2808"
      },
      {
        "trust": 0.2,
        "url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c01345499"
      },
      {
        "trust": 0.2,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.2,
        "url": "http://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.2,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-1741"
      },
      {
        "trust": 0.2,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-2566"
      },
      {
        "trust": 0.2,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5605"
      },
      {
        "trust": 0.2,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.2,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5606"
      },
      {
        "trust": 0.2,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5607"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1739"
      },
      {
        "trust": 0.1,
        "url": "http://kb.juniper.net/infocenter/index?page=content\u0026amp;id=jsa10705"
      },
      {
        "trust": 0.1,
        "url": "http://marc.info/?l=bugtraq\u0026amp;m=143039468003789\u0026amp;w=2"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/326.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/mikemackintosh/ruby-qualys"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/tzaffi/testssl-report"
      },
      {
        "trust": 0.1,
        "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=31809"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/2032-1/"
      },
      {
        "trust": 0.1,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/"
      },
      {
        "trust": 0.1,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/"
      },
      {
        "trust": 0.1,
        "url": "http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins"
      },
      {
        "trust": 0.1,
        "url": "https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsea"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1557"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1482"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1541"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1539"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1568"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5592"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5599"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1510"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1529"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-6671"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1550"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8631"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5593"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0834"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1500"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1508"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5613"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1480"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1491"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1512"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1560"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1534"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1581"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1479"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1494"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5600"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5600"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5595"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1478"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1580"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1594"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1502"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8634"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0821"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0833"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1589"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-6672"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8641"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1477"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0828"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1538"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8642"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1526"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0823"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5609"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1576"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-6673"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5604"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1555"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5595"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1486"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1567"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1564"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5616"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1563"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1591"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5612"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8640"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1561"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1485"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5597"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0831"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1505"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1525"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1496"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0819"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1583"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0829"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8636"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1544"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5598"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1481"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8639"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0817"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1548"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1536"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0825"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1553"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1489"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8638"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5599"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1497"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1551"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1558"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5591"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1542"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5602"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1578"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0826"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5618"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5590"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1520"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5603"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1511"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0832"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1592"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1549"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5612"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1566"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1543"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1577"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5601"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1498"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1524"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1584"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1565"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5615"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1547"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8635"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5610"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1556"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5593"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1514"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1531"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0830"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0822"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1533"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1585"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5603"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5619"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5613"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5615"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-5369"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1574"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1488"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1532"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1559"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0835"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5618"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1493"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1588"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5596"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1530"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1522"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1552"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1593"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8632"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1513"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5597"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1587"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0818"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1487"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1519"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1523"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1540"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1586"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1518"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1590"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5592"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5601"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1490"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1582"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0824"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5596"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-8637"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1483"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1499"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5619"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0827"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5604"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0836"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5609"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5614"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5591"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5598"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1562"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1509"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5610"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1537"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1545"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0820"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1554"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5616"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1575"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5614"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-5602"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-5590"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-1492"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.12.10.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.13.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.13.10.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/firefox/25.0.1+build1-0ubuntu0.12.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/bugs/1251576"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/thunderbird/1:24.1.1+build1-0ubuntu0.13.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/thunderbird/1:24.1.1+build1-0ubuntu0.12.10.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/bugs/1253027"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/thunderbird/1:24.1.1+build1-0ubuntu0.12.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/thunderbird/1:24.1.1+build1-0ubuntu0.13.10.1"
      },
      {
        "trust": 0.1,
        "url": "http://www.mandriva.com/en/support/security/"
      },
      {
        "trust": 0.1,
        "url": "http://www.mandriva.com/en/support/security/advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5605"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.mageia.org/show_bug.cgi?id=11669"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-1741"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-2566"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5606"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5607"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-1739"
      },
      {
        "trust": 0.1,
        "url": "https://developer.mozilla.org/en-us/docs/nss/nss_3.15.3_release_notes"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1620"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-1739"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-1620"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62568"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2566"
      },
      {
        "db": "BID",
        "id": "58796"
      },
      {
        "db": "PACKETSTORM",
        "id": "131694"
      },
      {
        "db": "PACKETSTORM",
        "id": "138866"
      },
      {
        "db": "PACKETSTORM",
        "id": "139894"
      },
      {
        "db": "PACKETSTORM",
        "id": "131314"
      },
      {
        "db": "PACKETSTORM",
        "id": "124083"
      },
      {
        "db": "PACKETSTORM",
        "id": "124122"
      },
      {
        "db": "PACKETSTORM",
        "id": "124085"
      },
      {
        "db": "PACKETSTORM",
        "id": "127174"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2566"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-62568",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2566",
        "ident": null
      },
      {
        "db": "BID",
        "id": "58796",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "131694",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "138866",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "139894",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "131314",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "124083",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "124122",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "124085",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "127174",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2566",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2013-03-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-62568",
        "ident": null
      },
      {
        "date": "2013-03-15T00:00:00",
        "db": "VULMON",
        "id": "CVE-2013-2566",
        "ident": null
      },
      {
        "date": "2013-03-12T00:00:00",
        "db": "BID",
        "id": "58796",
        "ident": null
      },
      {
        "date": "2015-04-30T15:46:16",
        "db": "PACKETSTORM",
        "id": "131694",
        "ident": null
      },
      {
        "date": "2016-09-27T13:59:31",
        "db": "PACKETSTORM",
        "id": "138866",
        "ident": null
      },
      {
        "date": "2016-11-24T11:11:00",
        "db": "PACKETSTORM",
        "id": "139894",
        "ident": null
      },
      {
        "date": "2015-04-07T16:00:47",
        "db": "PACKETSTORM",
        "id": "131314",
        "ident": null
      },
      {
        "date": "2013-11-20T21:51:54",
        "db": "PACKETSTORM",
        "id": "124083",
        "ident": null
      },
      {
        "date": "2013-11-21T19:32:02",
        "db": "PACKETSTORM",
        "id": "124122",
        "ident": null
      },
      {
        "date": "2013-11-20T21:53:52",
        "db": "PACKETSTORM",
        "id": "124085",
        "ident": null
      },
      {
        "date": "2014-06-24T00:56:06",
        "db": "PACKETSTORM",
        "id": "127174",
        "ident": null
      },
      {
        "date": "2013-03-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201303-335",
        "ident": null
      },
      {
        "date": "2013-03-15T21:55:01.047000",
        "db": "NVD",
        "id": "CVE-2013-2566",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2018-01-18T00:00:00",
        "db": "VULHUB",
        "id": "VHN-62568",
        "ident": null
      },
      {
        "date": "2020-11-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2013-2566",
        "ident": null
      },
      {
        "date": "2018-01-18T09:00:00",
        "db": "BID",
        "id": "58796",
        "ident": null
      },
      {
        "date": "2022-06-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201303-335",
        "ident": null
      },
      {
        "date": "2025-04-11T00:51:21.963000",
        "db": "NVD",
        "id": "CVE-2013-2566",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "131694"
      },
      {
        "db": "PACKETSTORM",
        "id": "124085"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335"
      }
    ],
    "trust": 0.8
  },
  "title": {
    "_id": null,
    "data": "TLS/SSL protocol  RC4 Algorithm encryption problem vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "_id": null,
    "data": "encryption problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201303-335"
      }
    ],
    "trust": 0.6
  }
}

VAR-202012-1277

Vulnerability from variot - Updated: 2026-03-09 21:22

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. HAXX Haxx curl is a set of file transfer tools that use the URL syntax to work under the command line of the Swedish Haxx (HAXX) company. The tool supports file upload and download and includes a libcurl (client URL transfer library) for program development. There is a security vulnerability in Haxx curl FTP PASV Responses. Attackers can use this vulnerability to bypass data access restrictions and obtain sensitive information through curl's FTP PASV Responses. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Debian Security Advisory DSA-4881-1 security@debian.org https://www.debian.org/security/ Alessandro Ghedini March 30, 2021 https://www.debian.org/security/faq

Package : curl CVE ID : CVE-2020-8169 CVE-2020-8177 CVE-2020-8231 CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 CVE-2021-22876 CVE-2021-22890 Debian Bug : 965280 965281 968831 977161 977162 977163

Multiple vulnerabilities were discovered in cURL, an URL transfer library:

CVE-2020-8169

Marek Szlagor reported that libcurl could be tricked into prepending
a part of the password to the host name before it resolves it,
potentially leaking the partial password over the network and to the
DNS server(s).

CVE-2020-8177

sn reported that curl could be tricked by a malicious server into
overwriting a local file when using th -J (--remote-header-name) and
-i (--include) options in the same command line.

CVE-2020-8231

Marc Aldorasi reported that libcurl might use the wrong connection
when an application using libcurl's multi API sets the option
CURLOPT_CONNECT_ONLY, which could lead to information leaks.

CVE-2020-8285

xnynx reported that libcurl could run out of stack space when using
tha FTP wildcard matching functionality (CURLOPT_CHUNK_BGN_FUNCTION).

CVE-2020-8286

It was reported that libcurl didn't verify that an OCSP response
actually matches the certificate it is intended to.

CVE-2021-22876

Viktor Szakats reported that libcurl does not strip off user
credentials from the URL when automatically populating the Referer
HTTP request header field in outgoing HTTP requests.

CVE-2021-22890

Mingtao Yang reported that, when using an HTTPS proxy and TLS 1.3,
libcurl could confuse session tickets arriving from the HTTPS proxy
as if they arrived from the remote server instead. This could allow
an HTTPS proxy to trick libcurl into using the wrong session ticket
for the host and thereby circumvent the server TLS certificate check.

For the stable distribution (buster), these problems have been fixed in version 7.64.0-4+deb10u2.

We recommend that you upgrade your curl packages.

For the detailed security status of curl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/curl

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBsId305pBx+F583DbwzL4CFiRygFAmBkQCoACgkQbwzL4CFi Ryg6Gg/+LqhhJ8+D7skevVkYzxHzdH2yT/XMeoYp0D37yHmEfH9PyjXwfplG+XEw /xwFRBK8qxD1ja+rQddYyeTvi1OMnMgMS3UsRHlfeMnLxh2+oHnvHDYG848npUEZ Rq4YFoc/n9YTAJZP/G4oiuBeXqH2Sqa5hSNT6VrYfRciCxkYnzA78b85KpI8aYyR lhfiJMNpwrqDbt/QzblpELBkGMIV402VeiqDwHfcVzm2E810xXQNLvPMbWtvDYkA TSrNsdqfuFr1tuQSZY6CGSWEyXtB/tOo8+pvUixlJMBWJMl5TXEcJkD5ckehx0yb C3n9yapfklxHiG9lD4zwwIJDqd3Y4SxdDiSlUC4OhdvpwniMygX0S3ICaPA4iac/ cWanml0Fop3OmRy+vQURTd3sADoT5HoRSUXZVU+HdTrRaEt2xs5okZkWSd3yr4Ux i+HgjUAFkkk8DLRB68Bbpx1LGxFGQT7L8yd4wsWINXlzASIP1A5dnNfE5w0VWOHG 3KDq47wNfjuiZC8GXW+HQCxz5MijnS8Y/Egl0OozNFDwEitNBZEsIjpZaZBdZIwi UFfcK7+u/y/TRY54rA4erkdcHFwpYW5EZVGdb7Z+WPWVlzw0ImXrM68LSAhHQaqW 1Hx4VwwwTsMIPnrx2kriRiiDPOW1r5Kip3yHa+QZLedSRGibQWk= =001T -----END PGP SIGNATURE----- . This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.

This release adds the new Apache HTTP Server 2.4.37 Service Pack 8 packages that are part of the JBoss Core Services offering.

Security Fix(es):

curl: Use-after-free in TLS session handling when using OpenSSL TLS backend (CVE-2021-22901)
httpd: NULL pointer dereference on specially crafted HTTP/2 request (CVE-2021-31618)
libcurl: partial password leak over DNS on HTTP redirect (CVE-2020-8169)
curl: FTP PASV command response can cause curl to connect to arbitrary host (CVE-2020-8284)
curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used (CVE-2020-8285)
curl: Inferior OCSP verification (CVE-2020-8286)
curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)
curl: TLS 1.3 session ticket mix-up with HTTPS proxy host (CVE-2021-22890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution:

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update. Bugs fixed (https://bugzilla.redhat.com/):

Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

1897635 - CVE-2020-28362 golang: math/big: panic during recursive division of very large numbers 1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve

JIRA issues fixed (https://issues.jboss.org/):

TRACING-1725 - Elasticsearch operator reports x509 errors communicating with ElasticSearch in OpenShift Service Mesh project

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

===================================================================== Red Hat Security Advisory

Synopsis: Moderate: OpenShift Container Platform 4.7.13 bug fix and security update Advisory ID: RHSA-2021:2121-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2021:2121 Issue date: 2021-06-01 CVE Names: CVE-2016-10228 CVE-2019-2708 CVE-2019-3842 CVE-2019-9169 CVE-2019-13012 CVE-2019-14866 CVE-2019-18811 CVE-2019-19523 CVE-2019-19528 CVE-2019-25013 CVE-2019-25032 CVE-2019-25034 CVE-2019-25035 CVE-2019-25036 CVE-2019-25037 CVE-2019-25038 CVE-2019-25039 CVE-2019-25040 CVE-2019-25041 CVE-2019-25042 CVE-2020-0431 CVE-2020-8231 CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 CVE-2020-8927 CVE-2020-9948 CVE-2020-9951 CVE-2020-9983 CVE-2020-10543 CVE-2020-10878 CVE-2020-11608 CVE-2020-12114 CVE-2020-12362 CVE-2020-12464 CVE-2020-13434 CVE-2020-13543 CVE-2020-13584 CVE-2020-13776 CVE-2020-14314 CVE-2020-14344 CVE-2020-14345 CVE-2020-14346 CVE-2020-14347 CVE-2020-14356 CVE-2020-14360 CVE-2020-14361 CVE-2020-14362 CVE-2020-14363 CVE-2020-15358 CVE-2020-15437 CVE-2020-15586 CVE-2020-16845 CVE-2020-24330 CVE-2020-24331 CVE-2020-24332 CVE-2020-24394 CVE-2020-24977 CVE-2020-25212 CVE-2020-25284 CVE-2020-25285 CVE-2020-25643 CVE-2020-25659 CVE-2020-25704 CVE-2020-25712 CVE-2020-26116 CVE-2020-26137 CVE-2020-27618 CVE-2020-27619 CVE-2020-27783 CVE-2020-27786 CVE-2020-27835 CVE-2020-28196 CVE-2020-28935 CVE-2020-28974 CVE-2020-29361 CVE-2020-29362 CVE-2020-29363 CVE-2020-35508 CVE-2020-36242 CVE-2020-36322 CVE-2021-0342 CVE-2021-3121 CVE-2021-3177 CVE-2021-3326 CVE-2021-21642 CVE-2021-21643 CVE-2021-21644 CVE-2021-21645 CVE-2021-23336 CVE-2021-25215 CVE-2021-30465 =====================================================================

Summary:

Red Hat OpenShift Container Platform release 4.7.13 is now available with updates to packages and images that fix several bugs.

This release includes a security update for Red Hat OpenShift Container Platform 4.7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.7.13. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2021:2122

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel ease-notes.html

This update fixes the following bug among others:

Previously, resources for the ClusterOperator were being created early in the update process, which led to update failures when the ClusterOperator had no status condition while Operators were updating. This bug fix changes the timing of when these resources are created. As a result, updates can take place without errors. (BZ#1959238)

Security Fix(es):

gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

You may download the oc tool and use it to inspect release image metadata as follows:

(For x86_64 architecture)

$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.7.13-x86_64

The image digest is sha256:783a2c963f35ccab38e82e6a8c7fa954c3a4551e07d2f43c06098828dd986ed4

(For s390x architecture)

$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.7.13-s390x

The image digest is sha256:4cf44e68413acad063203e1ee8982fd01d8b9c1f8643a5b31cd7ff341b3199cd

(For ppc64le architecture)

$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.7.13-ppc64le

The image digest is sha256:d47ce972f87f14f1f3c5d50428d2255d1256dae3f45c938ace88547478643e36

All OpenShift Container Platform 4.7 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster - -between-minor.html#understanding-upgrade-channels_updating-cluster-between - -minor

Solution:

For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel ease-notes.html

Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster - -cli.html

Bugs fixed (https://bugzilla.redhat.com/):

1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation 1923268 - [Assisted-4.7] [Staging] Using two both spelling "canceled" "cancelled" 1947216 - [AWS] Missing iam:ListAttachedRolePolicies permission in permissions.go 1953963 - Enable/Disable host operations returns cluster resource with incomplete hosts list 1957749 - ovn-kubernetes pod should have CPU and memory requests set but not limits 1959238 - CVO creating cloud-controller-manager too early causing upgrade failures 1960103 - SR-IOV obliviously reboot the node 1961941 - Local Storage Operator using LocalVolume CR fails to create PV's when backend storage failure is simulated 1962302 - packageserver clusteroperator does not set reason or message for Available condition 1962312 - Deployment considered unhealthy despite being available and at latest generation 1962435 - Public DNS records were not deleted when destroying a cluster which is using byo private hosted zone 1963115 - Test verify /run filesystem contents failing

References:

https://access.redhat.com/security/cve/CVE-2016-10228 https://access.redhat.com/security/cve/CVE-2019-2708 https://access.redhat.com/security/cve/CVE-2019-3842 https://access.redhat.com/security/cve/CVE-2019-9169 https://access.redhat.com/security/cve/CVE-2019-13012 https://access.redhat.com/security/cve/CVE-2019-14866 https://access.redhat.com/security/cve/CVE-2019-18811 https://access.redhat.com/security/cve/CVE-2019-19523 https://access.redhat.com/security/cve/CVE-2019-19528 https://access.redhat.com/security/cve/CVE-2019-25013 https://access.redhat.com/security/cve/CVE-2019-25032 https://access.redhat.com/security/cve/CVE-2019-25034 https://access.redhat.com/security/cve/CVE-2019-25035 https://access.redhat.com/security/cve/CVE-2019-25036 https://access.redhat.com/security/cve/CVE-2019-25037 https://access.redhat.com/security/cve/CVE-2019-25038 https://access.redhat.com/security/cve/CVE-2019-25039 https://access.redhat.com/security/cve/CVE-2019-25040 https://access.redhat.com/security/cve/CVE-2019-25041 https://access.redhat.com/security/cve/CVE-2019-25042 https://access.redhat.com/security/cve/CVE-2020-0431 https://access.redhat.com/security/cve/CVE-2020-8231 https://access.redhat.com/security/cve/CVE-2020-8284 https://access.redhat.com/security/cve/CVE-2020-8285 https://access.redhat.com/security/cve/CVE-2020-8286 https://access.redhat.com/security/cve/CVE-2020-8927 https://access.redhat.com/security/cve/CVE-2020-9948 https://access.redhat.com/security/cve/CVE-2020-9951 https://access.redhat.com/security/cve/CVE-2020-9983 https://access.redhat.com/security/cve/CVE-2020-10543 https://access.redhat.com/security/cve/CVE-2020-10878 https://access.redhat.com/security/cve/CVE-2020-11608 https://access.redhat.com/security/cve/CVE-2020-12114 https://access.redhat.com/security/cve/CVE-2020-12362 https://access.redhat.com/security/cve/CVE-2020-12464 https://access.redhat.com/security/cve/CVE-2020-13434 https://access.redhat.com/security/cve/CVE-2020-13543 https://access.redhat.com/security/cve/CVE-2020-13584 https://access.redhat.com/security/cve/CVE-2020-13776 https://access.redhat.com/security/cve/CVE-2020-14314 https://access.redhat.com/security/cve/CVE-2020-14344 https://access.redhat.com/security/cve/CVE-2020-14345 https://access.redhat.com/security/cve/CVE-2020-14346 https://access.redhat.com/security/cve/CVE-2020-14347 https://access.redhat.com/security/cve/CVE-2020-14356 https://access.redhat.com/security/cve/CVE-2020-14360 https://access.redhat.com/security/cve/CVE-2020-14361 https://access.redhat.com/security/cve/CVE-2020-14362 https://access.redhat.com/security/cve/CVE-2020-14363 https://access.redhat.com/security/cve/CVE-2020-15358 https://access.redhat.com/security/cve/CVE-2020-15437 https://access.redhat.com/security/cve/CVE-2020-15586 https://access.redhat.com/security/cve/CVE-2020-16845 https://access.redhat.com/security/cve/CVE-2020-24330 https://access.redhat.com/security/cve/CVE-2020-24331 https://access.redhat.com/security/cve/CVE-2020-24332 https://access.redhat.com/security/cve/CVE-2020-24394 https://access.redhat.com/security/cve/CVE-2020-24977 https://access.redhat.com/security/cve/CVE-2020-25212 https://access.redhat.com/security/cve/CVE-2020-25284 https://access.redhat.com/security/cve/CVE-2020-25285 https://access.redhat.com/security/cve/CVE-2020-25643 https://access.redhat.com/security/cve/CVE-2020-25659 https://access.redhat.com/security/cve/CVE-2020-25704 https://access.redhat.com/security/cve/CVE-2020-25712 https://access.redhat.com/security/cve/CVE-2020-26116 https://access.redhat.com/security/cve/CVE-2020-26137 https://access.redhat.com/security/cve/CVE-2020-27618 https://access.redhat.com/security/cve/CVE-2020-27619 https://access.redhat.com/security/cve/CVE-2020-27783 https://access.redhat.com/security/cve/CVE-2020-27786 https://access.redhat.com/security/cve/CVE-2020-27835 https://access.redhat.com/security/cve/CVE-2020-28196 https://access.redhat.com/security/cve/CVE-2020-28935 https://access.redhat.com/security/cve/CVE-2020-28974 https://access.redhat.com/security/cve/CVE-2020-29361 https://access.redhat.com/security/cve/CVE-2020-29362 https://access.redhat.com/security/cve/CVE-2020-29363 https://access.redhat.com/security/cve/CVE-2020-35508 https://access.redhat.com/security/cve/CVE-2020-36242 https://access.redhat.com/security/cve/CVE-2020-36322 https://access.redhat.com/security/cve/CVE-2021-0342 https://access.redhat.com/security/cve/CVE-2021-3121 https://access.redhat.com/security/cve/CVE-2021-3177 https://access.redhat.com/security/cve/CVE-2021-3326 https://access.redhat.com/security/cve/CVE-2021-21642 https://access.redhat.com/security/cve/CVE-2021-21643 https://access.redhat.com/security/cve/CVE-2021-21644 https://access.redhat.com/security/cve/CVE-2021-21645 https://access.redhat.com/security/cve/CVE-2021-23336 https://access.redhat.com/security/cve/CVE-2021-25215 https://access.redhat.com/security/cve/CVE-2021-30465 https://access.redhat.com/security/updates/classification/#moderate

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iQIVAwUBYLXBgdzjgjWX9erEAQiYKw/+MeUvVzbi9kHuo6vE8J9xEQCvgpJtLfRM yj4VFCt8lkWmfGmuAMd5LkvD5suav1Gu9yA6E60VvKrorV6+PDOZ8jiUyzRR+di6 TZZ7Ji6taqaQUuf451KF39zuxYAh29pKT6mZMhmqK65jEg7uj66R8+P2p7tahaai Kkqe6LKxNCXyVzWmc5HHkc3AJJ6vSVIuMeA6KOHpXy0vy57jZKeyb3dau0BVl/ir ZbnbOHdTJ+7hEVV3yGwARcVgUhHDcHiSYAS+RUj7Hqx0RIFilb9RbOdoEdbauaWx CGIdSYmj1F4apCZuYWmhZxtQ5/Lsj7EPi+7UleyTzqgMQsqSr8kvxGe/yzfY+yAQ ++QCSnleeKu/+HjN72d73h8yWGGzMrc/rYwDJWcFwjIL6/pj4Tgm4OK30vJlQUz5 3gHuEDz+j42s270cv6dRDd9v5xpexxIOXyHzruFRLk4xVCnS17PGeJ4I9mJmkYxL 5GuCiMnixToobWtmrh9MX2Qjkhj81o4E+rLMvG/4yUk2kGejo/nLwgZNsSz8gN5Z gMZOYSDys2zJu6/jmxY/8MXzS3yNIJj3FxXe7w5XA0mHUuuZ/EaJsMLnlCCSRARV GpMwj1/Aj1ZSNeYplr2YwQz7lB7hp+J/vn567zBPeYQus5EAyzqzudTbSLdm8ZyL PEh85hYKLe4= =Xe05 -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================== Ubuntu Security Notice USN-4665-2 December 09, 2020

curl vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 14.04 ESM
Ubuntu 12.04 ESM

Summary:

Several security issues were fixed in curl.

Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries

Details:

USN-4665-1 fixed several vulnerabilities in curl. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Varnavas Papaioannou discovered that curl incorrectly handled FTP PASV responses. (CVE-2020-8284)

It was discovered that curl incorrectly handled FTP wildcard matchins. A remote attacker could possibly use this issue to cause curl to consume resources and crash, resulting in a denial of service. (CVE-2020-8285)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 ESM: curl 7.35.0-1ubuntu2.20+esm6 libcurl3 7.35.0-1ubuntu2.20+esm6 libcurl3-gnutls 7.35.0-1ubuntu2.20+esm6 libcurl3-nss 7.35.0-1ubuntu2.20+esm6

Ubuntu 12.04 ESM: curl 7.22.0-3ubuntu4.29 libcurl3 7.22.0-3ubuntu4.29 libcurl3-gnutls 7.22.0-3ubuntu4.29 libcurl3-nss 7.22.0-3ubuntu4.29

In general, a standard system update will make all the necessary changes.

Security Fix(es):

golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)
golang: net: lookup functions may return invalid host names (CVE-2021-33195)
golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
golang: match/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader (CVE-2021-27918)
golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header (CVE-2021-31525)
golang: archive/zip: malformed archive may cause panic or memory exhaustion (CVE-2021-33196)

It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless client kn 1.16.0. This has been fixed (CVE-2021-3703). Bugs fixed (https://bugzilla.redhat.com/):

1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic 1983651 - Release of OpenShift Serverless Serving 1.17.0 1983654 - Release of OpenShift Serverless Eventing 1.17.0 1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names 1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty 1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents 1992955 - CVE-2021-3703 serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196

Show details on source website

JSON

To clipboard

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "33"
      },
      {
        "_id": null,
        "model": "macos",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "11.0.1"
      },
      {
        "_id": null,
        "model": "essbase",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "21.2"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "_id": null,
        "model": "clustered data ontap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "universal forwarder",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "8.2.12"
      },
      {
        "_id": null,
        "model": "communications billing and revenue management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0.3.0"
      },
      {
        "_id": null,
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.15.7"
      },
      {
        "_id": null,
        "model": "sinec infrastructure network services",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "1.0.1.1"
      },
      {
        "_id": null,
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "_id": null,
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "_id": null,
        "model": "mac os x",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.15"
      },
      {
        "_id": null,
        "model": "curl",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "haxx",
        "version": "7.73.0"
      },
      {
        "_id": null,
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.14.6"
      },
      {
        "_id": null,
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "_id": null,
        "model": "universal forwarder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "9.1.0"
      },
      {
        "_id": null,
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "32"
      },
      {
        "_id": null,
        "model": "universal forwarder",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "9.0.6"
      },
      {
        "_id": null,
        "model": "solidfire",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "macos",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "11.1"
      },
      {
        "_id": null,
        "model": "peoplesoft enterprise peopletools",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.58"
      },
      {
        "_id": null,
        "model": "universal forwarder",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "9.0.0"
      },
      {
        "_id": null,
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "_id": null,
        "model": "macos",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "11.2"
      },
      {
        "_id": null,
        "model": "universal forwarder",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "splunk",
        "version": "8.2.0"
      },
      {
        "_id": null,
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "_id": null,
        "model": "mac os x",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.15.7"
      },
      {
        "_id": null,
        "model": "hci management node",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "_id": null,
        "model": "mac os x",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.14.6"
      },
      {
        "_id": null,
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "_id": null,
        "model": "hci storage node",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "_id": null,
        "model": "hci bootstrap os",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "mac os x",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.14.0"
      },
      {
        "_id": null,
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3110"
      },
      {
        "_id": null,
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "_id": null,
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2410"
      },
      {
        "_id": null,
        "model": "communications cloud native core policy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.14.0"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-8284"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "db": "PACKETSTORM",
        "id": "163267"
      },
      {
        "db": "PACKETSTORM",
        "id": "163276"
      },
      {
        "db": "PACKETSTORM",
        "id": "162877"
      },
      {
        "db": "PACKETSTORM",
        "id": "164192"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2020-8284",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2020-8284",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.1,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-186409",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.2,
            "id": "CVE-2020-8284",
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-8284",
            "trust": 1.0,
            "value": "LOW"
          },
          {
            "author": "VULHUB",
            "id": "VHN-186409",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-8284",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186409"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8284"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8284"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. HAXX Haxx curl is a set of file transfer tools that use the URL syntax to work under the command line of the Swedish Haxx (HAXX) company. The tool supports file upload and download and includes a libcurl (client URL transfer library) for program development. There is a security vulnerability in Haxx curl FTP PASV Responses. Attackers can use this vulnerability to bypass data access restrictions and obtain sensitive information through curl\u0027s FTP PASV Responses. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4881-1                   security@debian.org\nhttps://www.debian.org/security/                       Alessandro Ghedini\nMarch 30, 2021                        https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage        : curl\nCVE ID         : CVE-2020-8169 CVE-2020-8177 CVE-2020-8231 CVE-2020-8284 \n                 CVE-2020-8285 CVE-2020-8286 CVE-2021-22876 CVE-2021-22890\nDebian Bug     : 965280 965281 968831 977161 977162 977163\n\nMultiple vulnerabilities were discovered in cURL, an URL transfer library:\n\nCVE-2020-8169\n\n    Marek Szlagor reported that libcurl could be tricked into prepending\n    a part of the password to the host name before it resolves it,\n    potentially leaking the partial password over the network and to the\n    DNS server(s). \n\nCVE-2020-8177\n\n    sn reported that curl could be tricked by a malicious server into\n    overwriting a local file when using th -J (--remote-header-name) and\n    -i (--include) options in the same command line. \n\nCVE-2020-8231\n\n    Marc Aldorasi reported that libcurl might use the wrong connection\n    when an application using libcurl\u0027s multi API sets the option\n    CURLOPT_CONNECT_ONLY, which could lead to information leaks. \n\nCVE-2020-8285\n\n    xnynx reported that libcurl could run out of stack space when using\n    tha FTP wildcard matching functionality (CURLOPT_CHUNK_BGN_FUNCTION). \n\nCVE-2020-8286\n\n    It was reported that libcurl didn\u0027t verify that an OCSP response\n    actually matches the certificate it is intended to. \n\nCVE-2021-22876\n\n    Viktor Szakats reported that libcurl does not strip off user\n    credentials from the URL when automatically populating the Referer\n    HTTP request header field in outgoing HTTP requests. \n\nCVE-2021-22890\n\n    Mingtao Yang reported that, when using an HTTPS proxy and TLS 1.3,\n    libcurl could confuse session tickets arriving from the HTTPS proxy\n    as if they arrived from the remote server instead. This could allow\n    an HTTPS proxy to trick libcurl into using the wrong session ticket\n    for the host and thereby circumvent the server TLS certificate check. \n\nFor the stable distribution (buster), these problems have been fixed in\nversion 7.64.0-4+deb10u2. \n\nWe recommend that you upgrade your curl packages. \n\nFor the detailed security status of curl please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/curl\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEBsId305pBx+F583DbwzL4CFiRygFAmBkQCoACgkQbwzL4CFi\nRyg6Gg/+LqhhJ8+D7skevVkYzxHzdH2yT/XMeoYp0D37yHmEfH9PyjXwfplG+XEw\n/xwFRBK8qxD1ja+rQddYyeTvi1OMnMgMS3UsRHlfeMnLxh2+oHnvHDYG848npUEZ\nRq4YFoc/n9YTAJZP/G4oiuBeXqH2Sqa5hSNT6VrYfRciCxkYnzA78b85KpI8aYyR\nlhfiJMNpwrqDbt/QzblpELBkGMIV402VeiqDwHfcVzm2E810xXQNLvPMbWtvDYkA\nTSrNsdqfuFr1tuQSZY6CGSWEyXtB/tOo8+pvUixlJMBWJMl5TXEcJkD5ckehx0yb\nC3n9yapfklxHiG9lD4zwwIJDqd3Y4SxdDiSlUC4OhdvpwniMygX0S3ICaPA4iac/\ncWanml0Fop3OmRy+vQURTd3sADoT5HoRSUXZVU+HdTrRaEt2xs5okZkWSd3yr4Ux\ni+HgjUAFkkk8DLRB68Bbpx1LGxFGQT7L8yd4wsWINXlzASIP1A5dnNfE5w0VWOHG\n3KDq47wNfjuiZC8GXW+HQCxz5MijnS8Y/Egl0OozNFDwEitNBZEsIjpZaZBdZIwi\nUFfcK7+u/y/TRY54rA4erkdcHFwpYW5EZVGdb7Z+WPWVlzw0ImXrM68LSAhHQaqW\n1Hx4VwwwTsMIPnrx2kriRiiDPOW1r5Kip3yHa+QZLedSRGibQWk=\n=001T\n-----END PGP SIGNATURE-----\n. This software, such as Apache HTTP Server, is\ncommon to multiple JBoss middleware products, and is packaged under Red Hat\nJBoss Core Services to allow for faster distribution of updates, and for a\nmore consistent update experience. \n\nThis release adds the new Apache HTTP Server 2.4.37 Service Pack 8 packages\nthat are part of the JBoss Core Services offering. \n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack\nApache Server 2.4.37 Service Pack 7 and includes bug fixes and\nenhancements. Refer to the Release Notes for information on the most\nsignificant bug fixes and enhancements included in this release. \n\nSecurity Fix(es):\n\n* curl: Use-after-free in TLS session handling when using OpenSSL TLS\nbackend (CVE-2021-22901)\n\n* httpd: NULL pointer dereference on specially crafted HTTP/2 request\n(CVE-2021-31618)\n\n* libcurl: partial password leak over DNS on HTTP redirect (CVE-2020-8169)\n\n* curl: FTP PASV command response can cause curl to connect to arbitrary\nhost (CVE-2020-8284)\n\n* curl: Malicious FTP server can trigger stack overflow when\nCURLOPT_CHUNK_BGN_FUNCTION is used (CVE-2020-8285)\n\n* curl: Inferior OCSP verification (CVE-2020-8286)\n\n* curl: Leak of authentication credentials in URL via automatic Referer\n(CVE-2021-22876)\n\n* curl: TLS 1.3 session ticket mix-up with HTTPS proxy host\n(CVE-2021-22890)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nThe References section of this erratum contains a download link for the\nupdate. You must be logged in to download the update. Bugs fixed (https://bugzilla.redhat.com/):\n\n1847916 - CVE-2020-8169 libcurl: partial password leak over DNS on HTTP redirect\n1902667 - CVE-2020-8284 curl: FTP PASV command response can cause curl to connect to arbitrary host\n1902687 - CVE-2020-8285 curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used\n1906096 - CVE-2020-8286 curl: Inferior OCSP verification\n1941964 - CVE-2021-22876 curl: Leak of authentication credentials in URL via automatic Referer\n1941965 - CVE-2021-22890 curl: TLS 1.3 session ticket mix-up with HTTPS proxy host\n1963146 - CVE-2021-22901 curl: Use-after-free in TLS session handling when using OpenSSL TLS backend\n1968013 - CVE-2021-31618 httpd: NULL pointer dereference on specially crafted HTTP/2 request\n\n5. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted\nautomatically. Applications using the APR libraries, such as httpd, must be\nrestarted for this update to take effect.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. Bugs fixed (https://bugzilla.redhat.com/):\n\n1897635 - CVE-2020-28362 golang: math/big: panic during recursive division of very large numbers\n1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve\n\n5. JIRA issues fixed (https://issues.jboss.org/):\n\nTRACING-1725 -  Elasticsearch operator reports x509 errors communicating with ElasticSearch in OpenShift Service Mesh project\n\n6. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Moderate: OpenShift Container Platform 4.7.13 bug fix and security update\nAdvisory ID:       RHSA-2021:2121-01\nProduct:           Red Hat OpenShift Enterprise\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2021:2121\nIssue date:        2021-06-01\nCVE Names:         CVE-2016-10228 CVE-2019-2708 CVE-2019-3842 \n                   CVE-2019-9169 CVE-2019-13012 CVE-2019-14866 \n                   CVE-2019-18811 CVE-2019-19523 CVE-2019-19528 \n                   CVE-2019-25013 CVE-2019-25032 CVE-2019-25034 \n                   CVE-2019-25035 CVE-2019-25036 CVE-2019-25037 \n                   CVE-2019-25038 CVE-2019-25039 CVE-2019-25040 \n                   CVE-2019-25041 CVE-2019-25042 CVE-2020-0431 \n                   CVE-2020-8231 CVE-2020-8284 CVE-2020-8285 \n                   CVE-2020-8286 CVE-2020-8927 CVE-2020-9948 \n                   CVE-2020-9951 CVE-2020-9983 CVE-2020-10543 \n                   CVE-2020-10878 CVE-2020-11608 CVE-2020-12114 \n                   CVE-2020-12362 CVE-2020-12464 CVE-2020-13434 \n                   CVE-2020-13543 CVE-2020-13584 CVE-2020-13776 \n                   CVE-2020-14314 CVE-2020-14344 CVE-2020-14345 \n                   CVE-2020-14346 CVE-2020-14347 CVE-2020-14356 \n                   CVE-2020-14360 CVE-2020-14361 CVE-2020-14362 \n                   CVE-2020-14363 CVE-2020-15358 CVE-2020-15437 \n                   CVE-2020-15586 CVE-2020-16845 CVE-2020-24330 \n                   CVE-2020-24331 CVE-2020-24332 CVE-2020-24394 \n                   CVE-2020-24977 CVE-2020-25212 CVE-2020-25284 \n                   CVE-2020-25285 CVE-2020-25643 CVE-2020-25659 \n                   CVE-2020-25704 CVE-2020-25712 CVE-2020-26116 \n                   CVE-2020-26137 CVE-2020-27618 CVE-2020-27619 \n                   CVE-2020-27783 CVE-2020-27786 CVE-2020-27835 \n                   CVE-2020-28196 CVE-2020-28935 CVE-2020-28974 \n                   CVE-2020-29361 CVE-2020-29362 CVE-2020-29363 \n                   CVE-2020-35508 CVE-2020-36242 CVE-2020-36322 \n                   CVE-2021-0342 CVE-2021-3121 CVE-2021-3177 \n                   CVE-2021-3326 CVE-2021-21642 CVE-2021-21643 \n                   CVE-2021-21644 CVE-2021-21645 CVE-2021-23336 \n                   CVE-2021-25215 CVE-2021-30465 \n=====================================================================\n\n1. Summary:\n\nRed Hat OpenShift Container Platform release 4.7.13 is now available with\nupdates to packages and images that fix several bugs. \n\nThis release includes a security update for Red Hat OpenShift Container\nPlatform 4.7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments. \n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.7.13. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHSA-2021:2122\n\nSpace precludes documenting all of the container images in this advisory. \nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel\nease-notes.html\n\nThis update fixes the following bug among others:\n\n* Previously, resources for the ClusterOperator were being created early in\nthe update process, which led to update failures when the ClusterOperator\nhad no status condition while Operators were updating. This bug fix changes\nthe timing of when these resources are created. As a result, updates can\ntake place without errors. (BZ#1959238)\n\nSecurity Fix(es):\n\n* gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index\nvalidation (CVE-2021-3121)\n\nYou may download the oc tool and use it to inspect release image metadata\nas follows:\n\n(For x86_64 architecture)\n\n  $ oc adm release info\nquay.io/openshift-release-dev/ocp-release:4.7.13-x86_64\n\nThe image digest is\nsha256:783a2c963f35ccab38e82e6a8c7fa954c3a4551e07d2f43c06098828dd986ed4\n\n(For s390x architecture)\n\n  $ oc adm release info\nquay.io/openshift-release-dev/ocp-release:4.7.13-s390x\n\nThe image digest is\nsha256:4cf44e68413acad063203e1ee8982fd01d8b9c1f8643a5b31cd7ff341b3199cd\n\n(For ppc64le architecture)\n\n  $ oc adm release info\nquay.io/openshift-release-dev/ocp-release:4.7.13-ppc64le\n\nThe image digest is\nsha256:d47ce972f87f14f1f3c5d50428d2255d1256dae3f45c938ace88547478643e36\n\nAll OpenShift Container Platform 4.7 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift Console\nor the CLI oc command. Instructions for upgrading a cluster are available\nat\nhttps://docs.openshift.com/container-platform/4.7/updating/updating-cluster\n- -between-minor.html#understanding-upgrade-channels_updating-cluster-between\n- -minor\n\n3. Solution:\n\nFor OpenShift Container Platform 4.7 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel\nease-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.7/updating/updating-cluster\n- -cli.html\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation\n1923268 - [Assisted-4.7] [Staging] Using two both spelling \"canceled\"  \"cancelled\"\n1947216 - [AWS] Missing iam:ListAttachedRolePolicies permission in permissions.go\n1953963 - Enable/Disable host operations returns cluster resource with incomplete hosts list\n1957749 - ovn-kubernetes pod should have CPU and memory requests set but not limits\n1959238 - CVO creating cloud-controller-manager too early causing upgrade failures\n1960103 - SR-IOV obliviously reboot the node\n1961941 - Local Storage Operator using LocalVolume CR fails to create PV\u0027s when backend storage failure is simulated\n1962302 - packageserver clusteroperator does not set reason or message for Available condition\n1962312 - Deployment considered unhealthy despite being available and at latest generation\n1962435 - Public DNS records were not deleted when destroying a cluster which is using byo private hosted zone\n1963115 - Test verify /run filesystem contents failing\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2016-10228\nhttps://access.redhat.com/security/cve/CVE-2019-2708\nhttps://access.redhat.com/security/cve/CVE-2019-3842\nhttps://access.redhat.com/security/cve/CVE-2019-9169\nhttps://access.redhat.com/security/cve/CVE-2019-13012\nhttps://access.redhat.com/security/cve/CVE-2019-14866\nhttps://access.redhat.com/security/cve/CVE-2019-18811\nhttps://access.redhat.com/security/cve/CVE-2019-19523\nhttps://access.redhat.com/security/cve/CVE-2019-19528\nhttps://access.redhat.com/security/cve/CVE-2019-25013\nhttps://access.redhat.com/security/cve/CVE-2019-25032\nhttps://access.redhat.com/security/cve/CVE-2019-25034\nhttps://access.redhat.com/security/cve/CVE-2019-25035\nhttps://access.redhat.com/security/cve/CVE-2019-25036\nhttps://access.redhat.com/security/cve/CVE-2019-25037\nhttps://access.redhat.com/security/cve/CVE-2019-25038\nhttps://access.redhat.com/security/cve/CVE-2019-25039\nhttps://access.redhat.com/security/cve/CVE-2019-25040\nhttps://access.redhat.com/security/cve/CVE-2019-25041\nhttps://access.redhat.com/security/cve/CVE-2019-25042\nhttps://access.redhat.com/security/cve/CVE-2020-0431\nhttps://access.redhat.com/security/cve/CVE-2020-8231\nhttps://access.redhat.com/security/cve/CVE-2020-8284\nhttps://access.redhat.com/security/cve/CVE-2020-8285\nhttps://access.redhat.com/security/cve/CVE-2020-8286\nhttps://access.redhat.com/security/cve/CVE-2020-8927\nhttps://access.redhat.com/security/cve/CVE-2020-9948\nhttps://access.redhat.com/security/cve/CVE-2020-9951\nhttps://access.redhat.com/security/cve/CVE-2020-9983\nhttps://access.redhat.com/security/cve/CVE-2020-10543\nhttps://access.redhat.com/security/cve/CVE-2020-10878\nhttps://access.redhat.com/security/cve/CVE-2020-11608\nhttps://access.redhat.com/security/cve/CVE-2020-12114\nhttps://access.redhat.com/security/cve/CVE-2020-12362\nhttps://access.redhat.com/security/cve/CVE-2020-12464\nhttps://access.redhat.com/security/cve/CVE-2020-13434\nhttps://access.redhat.com/security/cve/CVE-2020-13543\nhttps://access.redhat.com/security/cve/CVE-2020-13584\nhttps://access.redhat.com/security/cve/CVE-2020-13776\nhttps://access.redhat.com/security/cve/CVE-2020-14314\nhttps://access.redhat.com/security/cve/CVE-2020-14344\nhttps://access.redhat.com/security/cve/CVE-2020-14345\nhttps://access.redhat.com/security/cve/CVE-2020-14346\nhttps://access.redhat.com/security/cve/CVE-2020-14347\nhttps://access.redhat.com/security/cve/CVE-2020-14356\nhttps://access.redhat.com/security/cve/CVE-2020-14360\nhttps://access.redhat.com/security/cve/CVE-2020-14361\nhttps://access.redhat.com/security/cve/CVE-2020-14362\nhttps://access.redhat.com/security/cve/CVE-2020-14363\nhttps://access.redhat.com/security/cve/CVE-2020-15358\nhttps://access.redhat.com/security/cve/CVE-2020-15437\nhttps://access.redhat.com/security/cve/CVE-2020-15586\nhttps://access.redhat.com/security/cve/CVE-2020-16845\nhttps://access.redhat.com/security/cve/CVE-2020-24330\nhttps://access.redhat.com/security/cve/CVE-2020-24331\nhttps://access.redhat.com/security/cve/CVE-2020-24332\nhttps://access.redhat.com/security/cve/CVE-2020-24394\nhttps://access.redhat.com/security/cve/CVE-2020-24977\nhttps://access.redhat.com/security/cve/CVE-2020-25212\nhttps://access.redhat.com/security/cve/CVE-2020-25284\nhttps://access.redhat.com/security/cve/CVE-2020-25285\nhttps://access.redhat.com/security/cve/CVE-2020-25643\nhttps://access.redhat.com/security/cve/CVE-2020-25659\nhttps://access.redhat.com/security/cve/CVE-2020-25704\nhttps://access.redhat.com/security/cve/CVE-2020-25712\nhttps://access.redhat.com/security/cve/CVE-2020-26116\nhttps://access.redhat.com/security/cve/CVE-2020-26137\nhttps://access.redhat.com/security/cve/CVE-2020-27618\nhttps://access.redhat.com/security/cve/CVE-2020-27619\nhttps://access.redhat.com/security/cve/CVE-2020-27783\nhttps://access.redhat.com/security/cve/CVE-2020-27786\nhttps://access.redhat.com/security/cve/CVE-2020-27835\nhttps://access.redhat.com/security/cve/CVE-2020-28196\nhttps://access.redhat.com/security/cve/CVE-2020-28935\nhttps://access.redhat.com/security/cve/CVE-2020-28974\nhttps://access.redhat.com/security/cve/CVE-2020-29361\nhttps://access.redhat.com/security/cve/CVE-2020-29362\nhttps://access.redhat.com/security/cve/CVE-2020-29363\nhttps://access.redhat.com/security/cve/CVE-2020-35508\nhttps://access.redhat.com/security/cve/CVE-2020-36242\nhttps://access.redhat.com/security/cve/CVE-2020-36322\nhttps://access.redhat.com/security/cve/CVE-2021-0342\nhttps://access.redhat.com/security/cve/CVE-2021-3121\nhttps://access.redhat.com/security/cve/CVE-2021-3177\nhttps://access.redhat.com/security/cve/CVE-2021-3326\nhttps://access.redhat.com/security/cve/CVE-2021-21642\nhttps://access.redhat.com/security/cve/CVE-2021-21643\nhttps://access.redhat.com/security/cve/CVE-2021-21644\nhttps://access.redhat.com/security/cve/CVE-2021-21645\nhttps://access.redhat.com/security/cve/CVE-2021-23336\nhttps://access.redhat.com/security/cve/CVE-2021-25215\nhttps://access.redhat.com/security/cve/CVE-2021-30465\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYLXBgdzjgjWX9erEAQiYKw/+MeUvVzbi9kHuo6vE8J9xEQCvgpJtLfRM\nyj4VFCt8lkWmfGmuAMd5LkvD5suav1Gu9yA6E60VvKrorV6+PDOZ8jiUyzRR+di6\nTZZ7Ji6taqaQUuf451KF39zuxYAh29pKT6mZMhmqK65jEg7uj66R8+P2p7tahaai\nKkqe6LKxNCXyVzWmc5HHkc3AJJ6vSVIuMeA6KOHpXy0vy57jZKeyb3dau0BVl/ir\nZbnbOHdTJ+7hEVV3yGwARcVgUhHDcHiSYAS+RUj7Hqx0RIFilb9RbOdoEdbauaWx\nCGIdSYmj1F4apCZuYWmhZxtQ5/Lsj7EPi+7UleyTzqgMQsqSr8kvxGe/yzfY+yAQ\n++QCSnleeKu/+HjN72d73h8yWGGzMrc/rYwDJWcFwjIL6/pj4Tgm4OK30vJlQUz5\n3gHuEDz+j42s270cv6dRDd9v5xpexxIOXyHzruFRLk4xVCnS17PGeJ4I9mJmkYxL\n5GuCiMnixToobWtmrh9MX2Qjkhj81o4E+rLMvG/4yUk2kGejo/nLwgZNsSz8gN5Z\ngMZOYSDys2zJu6/jmxY/8MXzS3yNIJj3FxXe7w5XA0mHUuuZ/EaJsMLnlCCSRARV\nGpMwj1/Aj1ZSNeYplr2YwQz7lB7hp+J/vn567zBPeYQus5EAyzqzudTbSLdm8ZyL\nPEh85hYKLe4=\n=Xe05\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. ==========================================================================\nUbuntu Security Notice USN-4665-2\nDecember 09, 2020\n\ncurl vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 14.04 ESM\n- Ubuntu 12.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in curl. \n\nSoftware Description:\n- curl: HTTP, HTTPS, and FTP client and client libraries\n\nDetails:\n\nUSN-4665-1 fixed several vulnerabilities in curl. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. \n\nOriginal advisory details:\n\n Varnavas Papaioannou discovered that curl incorrectly handled FTP PASV\n responses. (CVE-2020-8284)\n\n It was discovered that curl incorrectly handled FTP wildcard matchins. A\n remote attacker could possibly use this issue to cause curl to consume\n resources and crash, resulting in a denial of service. (CVE-2020-8285)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 14.04 ESM:\n  curl                            7.35.0-1ubuntu2.20+esm6\n  libcurl3                        7.35.0-1ubuntu2.20+esm6\n  libcurl3-gnutls                 7.35.0-1ubuntu2.20+esm6\n  libcurl3-nss                    7.35.0-1ubuntu2.20+esm6\n\nUbuntu 12.04 ESM:\n  curl                            7.22.0-3ubuntu4.29\n  libcurl3                        7.22.0-3ubuntu4.29\n  libcurl3-gnutls                 7.22.0-3ubuntu4.29\n  libcurl3-nss                    7.22.0-3ubuntu4.29\n\nIn general, a standard system update will make all the necessary changes. \n\nSecurity Fix(es):\n\n* golang: crypto/tls: certificate of wrong type is causing TLS client to\npanic\n(CVE-2021-34558)\n* golang: net: lookup functions may return invalid host names\n(CVE-2021-33195)\n* golang: net/http/httputil: ReverseProxy forwards connection headers if\nfirst one is empty (CVE-2021-33197)\n* golang: match/big.Rat: may cause a panic or an unrecoverable fatal error\nif passed inputs with very large exponents (CVE-2021-33198)\n* golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a\ncustom TokenReader (CVE-2021-27918)\n* golang: net/http: panic in ReadRequest and ReadResponse when reading a\nvery large header (CVE-2021-31525)\n* golang: archive/zip: malformed archive may cause panic or memory\nexhaustion (CVE-2021-33196)\n\nIt was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196\nhave been incorrectly mentioned as fixed in RHSA for Serverless client kn\n1.16.0. This has been fixed (CVE-2021-3703). Bugs fixed (https://bugzilla.redhat.com/):\n\n1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic\n1983651 - Release of OpenShift Serverless Serving 1.17.0\n1983654 - Release of OpenShift Serverless Eventing 1.17.0\n1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names\n1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty\n1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents\n1992955 - CVE-2021-3703 serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196\n\n5",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-8284"
      },
      {
        "db": "VULHUB",
        "id": "VHN-186409"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8284"
      },
      {
        "db": "PACKETSTORM",
        "id": "169015"
      },
      {
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "db": "PACKETSTORM",
        "id": "163267"
      },
      {
        "db": "PACKETSTORM",
        "id": "163276"
      },
      {
        "db": "PACKETSTORM",
        "id": "162877"
      },
      {
        "db": "PACKETSTORM",
        "id": "160436"
      },
      {
        "db": "PACKETSTORM",
        "id": "164192"
      }
    ],
    "trust": 1.8
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-8284",
        "trust": 2.0
      },
      {
        "db": "SIEMENS",
        "id": "SSA-389290",
        "trust": 1.1
      },
      {
        "db": "HACKERONE",
        "id": "1040166",
        "trust": 1.1
      },
      {
        "db": "PACKETSTORM",
        "id": "160436",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "163197",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "163267",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "163276",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "163193",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "160706",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "163257",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "163496",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "160423",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "162629",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-186409",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8284",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "169015",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "162877",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "164192",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186409"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8284"
      },
      {
        "db": "PACKETSTORM",
        "id": "169015"
      },
      {
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "db": "PACKETSTORM",
        "id": "163267"
      },
      {
        "db": "PACKETSTORM",
        "id": "163276"
      },
      {
        "db": "PACKETSTORM",
        "id": "162877"
      },
      {
        "db": "PACKETSTORM",
        "id": "160436"
      },
      {
        "db": "PACKETSTORM",
        "id": "164192"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8284"
      }
    ]
  },
  "id": "VAR-202012-1277",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186409"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2026-03-09T21:22:59.757000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "Debian CVElist Bug Report Logs: curl: CVE-2020-8284: trusting FTP PASV responses",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=0ffb05dc08c6c9f5251a5fb47d2c1b45"
      },
      {
        "title": "IBM: Security Bulletin: IBM MQ is affected by a vulnerability within libcurl (CVE-2020-8284)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=8dce374d73a7e6e542a5aecc279d3c25"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2020-8284 log"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2021-1693",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2021-1693"
      },
      {
        "title": "Debian Security Advisories: DSA-4881-1 curl -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=a9706a30f62799ecc4d45bdb53c244eb"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=4a9822530e6b610875f83ffc10e02aba"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=ec6577109e640dac19a6ddb978afe82d"
      },
      {
        "title": "evilFTP",
        "trust": 0.1,
        "url": "https://github.com/vp777/evilFTP "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Live-Hack-CVE/CVE-2021-40491 "
      },
      {
        "title": "surferFTP",
        "trust": 0.1,
        "url": "https://github.com/vp777/surferFTP "
      },
      {
        "title": "clair-client",
        "trust": 0.1,
        "url": "https://github.com/indece-official/clair-client "
      },
      {
        "title": "PIA-PC",
        "trust": 0.1,
        "url": "https://github.com/zanezhub/PIA-PC "
      },
      {
        "title": "myapp-container-jaxrs",
        "trust": 0.1,
        "url": "https://github.com/akiraabe/myapp-container-jaxrs "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-8284"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.1
      },
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186409"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8284"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 1.1,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
      },
      {
        "trust": 1.1,
        "url": "https://security.netapp.com/advisory/ntap-20210122-0007/"
      },
      {
        "trust": 1.1,
        "url": "https://support.apple.com/kb/ht212325"
      },
      {
        "trust": 1.1,
        "url": "https://support.apple.com/kb/ht212326"
      },
      {
        "trust": 1.1,
        "url": "https://support.apple.com/kb/ht212327"
      },
      {
        "trust": 1.1,
        "url": "https://www.debian.org/security/2021/dsa-4881"
      },
      {
        "trust": 1.1,
        "url": "https://security.gentoo.org/glsa/202012-14"
      },
      {
        "trust": 1.1,
        "url": "https://curl.se/docs/cve-2020-8284.html"
      },
      {
        "trust": 1.1,
        "url": "https://hackerone.com/reports/1040166"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
      },
      {
        "trust": 1.1,
        "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/nzuvsqhn2eshmjxnq2z7t2eelbb5hjxg/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/daehe2s2qlo4ao4meeyl75nb7sah5psl/"
      },
      {
        "trust": 0.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8284"
      },
      {
        "trust": 0.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8285"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8286"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2020-8286"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2020-8285"
      },
      {
        "trust": 0.6,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2020-8284"
      },
      {
        "trust": 0.6,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8231"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-25013"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-29361"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-2708"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-28196"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-15358"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-8927"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-29362"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-9169"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-29363"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-10228"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-13434"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2708"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2016-10228"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-8231"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25013"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2021-3326"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-9169"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-27618"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-22876"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8169"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-22890"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-29362"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2021-20305"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2021-23336"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15358"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-20305"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13434"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2017-14502"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-14502"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27618"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-26116"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-3842"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8927"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-29363"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-27619"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-24977"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-3842"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-13776"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2021-3177"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2021-3449"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2021-3450"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-29361"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-28196"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-22901"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-22901"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-22876"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-22890"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-31618"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-31618"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-8169"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-26116"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-28362"
      },
      {
        "trust": 0.2,
        "url": "https://docs.openshift.com/container-platform/4.7/jaeger/jaeger_install/rhb"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-3114"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-28362"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13776"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-23336"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-27219"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27619"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-24977"
      },
      {
        "trust": 0.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/daehe2s2qlo4ao4meeyl75nb7sah5psl/"
      },
      {
        "trust": 0.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/nzuvsqhn2eshmjxnq2z7t2eelbb5hjxg/"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/curl"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8177"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.apachehttp\u0026downloadtype=securitypatches\u0026version=2.4.37"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.openssl\u0026downloadtype=securitypatches\u0026version=1.1.1g"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2471"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2472"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-27219"
      },
      {
        "trust": 0.1,
        "url": "https://issues.jboss.org/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2532"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-3114"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-28500"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-28500"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13949"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2543"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13949"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-23337"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25039"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14347"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-36322"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-12114"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25712"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-15586"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12114"
      },
      {
        "trust": 0.1,
        "url": "https://docs.openshift.com/container-platform/4.7/updating/updating-cluster"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13543"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-27835"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-9951"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25704"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25037"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-36242"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25037"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3121"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10878"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19528"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-9948"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-13012"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-28935"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-0431"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25034"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-16845"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25035"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-14866"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14363"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25038"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14866"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13584"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-26137"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-18811"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14360"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21645"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25040"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-27783"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-19528"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-12464"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-24330"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14314"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25042"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25042"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-12362"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25038"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25659"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25032"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14356"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25041"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25036"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25032"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21643"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-27786"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-25215"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25643"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-9983"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-24331"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25036"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-24394"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-0431"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-0342"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-18811"
      },
      {
        "trust": 0.1,
        "url": "https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-30465"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25035"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14345"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14344"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-19523"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14362"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21644"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14361"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10543"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25285"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-35508"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12362"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25212"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19523"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-28974"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2121"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-24332"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10543"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25039"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-15437"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-13012"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25284"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14346"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-25040"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10878"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25041"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11608"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:2122"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11608"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-21642"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12464"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-25034"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4665-1"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4665-2"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3537"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-27918"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-33196"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-33195"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-27918"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-27218"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3520"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-33196"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-33197"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-33195"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-33198"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-33198"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-31525"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-27218"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-34558"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:3556"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-3326"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3516"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-33197"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-20271"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3518"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3517"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3421"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-31525"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-20271"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3703"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3541"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186409"
      },
      {
        "db": "PACKETSTORM",
        "id": "169015"
      },
      {
        "db": "PACKETSTORM",
        "id": "163193"
      },
      {
        "db": "PACKETSTORM",
        "id": "163197"
      },
      {
        "db": "PACKETSTORM",
        "id": "163267"
      },
      {
        "db": "PACKETSTORM",
        "id": "163276"
      },
      {
        "db": "PACKETSTORM",
        "id": "162877"
      },
      {
        "db": "PACKETSTORM",
        "id": "160436"
      },
      {
        "db": "PACKETSTORM",
        "id": "164192"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8284"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-186409",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8284",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "169015",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "163193",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "163197",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "163267",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "163276",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "162877",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "160436",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "164192",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8284",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2020-12-14T00:00:00",
        "db": "VULHUB",
        "id": "VHN-186409",
        "ident": null
      },
      {
        "date": "2020-12-14T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-8284",
        "ident": null
      },
      {
        "date": "2021-03-28T19:12:00",
        "db": "PACKETSTORM",
        "id": "169015",
        "ident": null
      },
      {
        "date": "2021-06-17T18:01:23",
        "db": "PACKETSTORM",
        "id": "163193",
        "ident": null
      },
      {
        "date": "2021-06-17T18:09:26",
        "db": "PACKETSTORM",
        "id": "163197",
        "ident": null
      },
      {
        "date": "2021-06-23T16:08:25",
        "db": "PACKETSTORM",
        "id": "163267",
        "ident": null
      },
      {
        "date": "2021-06-24T17:54:53",
        "db": "PACKETSTORM",
        "id": "163276",
        "ident": null
      },
      {
        "date": "2021-06-01T14:45:29",
        "db": "PACKETSTORM",
        "id": "162877",
        "ident": null
      },
      {
        "date": "2020-12-10T16:02:10",
        "db": "PACKETSTORM",
        "id": "160436",
        "ident": null
      },
      {
        "date": "2021-09-17T16:04:56",
        "db": "PACKETSTORM",
        "id": "164192",
        "ident": null
      },
      {
        "date": "2020-12-14T20:15:13.903000",
        "db": "NVD",
        "id": "CVE-2020-8284",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2022-05-13T00:00:00",
        "db": "VULHUB",
        "id": "VHN-186409",
        "ident": null
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-8284",
        "ident": null
      },
      {
        "date": "2024-11-21T05:38:39.193000",
        "db": "NVD",
        "id": "CVE-2020-8284",
        "ident": null
      }
    ]
  },
  "title": {
    "_id": null,
    "data": "Debian Security Advisory 4881-1",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "169015"
      }
    ],
    "trust": 0.1
  },
  "type": {
    "_id": null,
    "data": "code execution",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "163276"
      }
    ],
    "trust": 0.1
  }
}

VAR-201711-0007

Vulnerability from variot - Updated: 2026-03-09 20:19

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. OpenSSL is prone to denial-of-service vulnerability. Successful exploitation of the issue will cause excessive memory or CPU resource consumption, resulting in a denial-of-service condition. It supports a variety of encryption algorithms, including symmetric ciphers, hash algorithms, security hashing algorithm, etc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

===================================================================== Red Hat Security Advisory

Synopsis: Moderate: openssl security update Advisory ID: RHSA-2017:0286-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2017-0286.html Issue date: 2017-02-20 CVE Names: CVE-2016-8610 CVE-2017-3731 =====================================================================

Summary:

An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Description:

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

An integer underflow leading to an out of bounds read flaw was found in OpenSSL. (CVE-2016-8610)
Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

Bugs fixed (https://bugzilla.redhat.com/):

1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS 1416852 - CVE-2017-3731 openssl: Truncated packet could crash via OOB read

Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source: openssl-1.0.1e-48.el6_8.4.src.rpm

i386: openssl-1.0.1e-48.el6_8.4.i686.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm

x86_64: openssl-1.0.1e-48.el6_8.4.i686.rpm openssl-1.0.1e-48.el6_8.4.x86_64.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

i386: openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm openssl-devel-1.0.1e-48.el6_8.4.i686.rpm openssl-perl-1.0.1e-48.el6_8.4.i686.rpm openssl-static-1.0.1e-48.el6_8.4.i686.rpm

x86_64: openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm openssl-devel-1.0.1e-48.el6_8.4.i686.rpm openssl-devel-1.0.1e-48.el6_8.4.x86_64.rpm openssl-perl-1.0.1e-48.el6_8.4.x86_64.rpm openssl-static-1.0.1e-48.el6_8.4.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source: openssl-1.0.1e-48.el6_8.4.src.rpm

x86_64: openssl-1.0.1e-48.el6_8.4.i686.rpm openssl-1.0.1e-48.el6_8.4.x86_64.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Red Hat Enterprise Linux Server (v. 6):

Source: openssl-1.0.1e-48.el6_8.4.src.rpm

i386: openssl-1.0.1e-48.el6_8.4.i686.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm openssl-devel-1.0.1e-48.el6_8.4.i686.rpm

ppc64: openssl-1.0.1e-48.el6_8.4.ppc.rpm openssl-1.0.1e-48.el6_8.4.ppc64.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.ppc.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.ppc64.rpm openssl-devel-1.0.1e-48.el6_8.4.ppc.rpm openssl-devel-1.0.1e-48.el6_8.4.ppc64.rpm

s390x: openssl-1.0.1e-48.el6_8.4.s390.rpm openssl-1.0.1e-48.el6_8.4.s390x.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.s390.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.s390x.rpm openssl-devel-1.0.1e-48.el6_8.4.s390.rpm openssl-devel-1.0.1e-48.el6_8.4.s390x.rpm

x86_64: openssl-1.0.1e-48.el6_8.4.i686.rpm openssl-1.0.1e-48.el6_8.4.x86_64.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm openssl-devel-1.0.1e-48.el6_8.4.i686.rpm openssl-devel-1.0.1e-48.el6_8.4.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

i386: openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm openssl-perl-1.0.1e-48.el6_8.4.i686.rpm openssl-static-1.0.1e-48.el6_8.4.i686.rpm

ppc64: openssl-debuginfo-1.0.1e-48.el6_8.4.ppc64.rpm openssl-perl-1.0.1e-48.el6_8.4.ppc64.rpm openssl-static-1.0.1e-48.el6_8.4.ppc64.rpm

s390x: openssl-debuginfo-1.0.1e-48.el6_8.4.s390x.rpm openssl-perl-1.0.1e-48.el6_8.4.s390x.rpm openssl-static-1.0.1e-48.el6_8.4.s390x.rpm

x86_64: openssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm openssl-perl-1.0.1e-48.el6_8.4.x86_64.rpm openssl-static-1.0.1e-48.el6_8.4.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source: openssl-1.0.1e-48.el6_8.4.src.rpm

i386: openssl-1.0.1e-48.el6_8.4.i686.rpm openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm openssl-devel-1.0.1e-48.el6_8.4.i686.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

i386: openssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm openssl-perl-1.0.1e-48.el6_8.4.i686.rpm openssl-static-1.0.1e-48.el6_8.4.i686.rpm

x86_64: openssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm openssl-perl-1.0.1e-48.el6_8.4.x86_64.rpm openssl-static-1.0.1e-48.el6_8.4.x86_64.rpm

Red Hat Enterprise Linux Client (v. 7):

Source: openssl-1.0.1e-60.el7_3.1.src.rpm

x86_64: openssl-1.0.1e-60.el7_3.1.x86_64.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm openssl-libs-1.0.1e-60.el7_3.1.i686.rpm openssl-libs-1.0.1e-60.el7_3.1.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64: openssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm openssl-devel-1.0.1e-60.el7_3.1.i686.rpm openssl-devel-1.0.1e-60.el7_3.1.x86_64.rpm openssl-perl-1.0.1e-60.el7_3.1.x86_64.rpm openssl-static-1.0.1e-60.el7_3.1.i686.rpm openssl-static-1.0.1e-60.el7_3.1.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source: openssl-1.0.1e-60.el7_3.1.src.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

Red Hat Enterprise Linux Server (v. 7):

Source: openssl-1.0.1e-60.el7_3.1.src.rpm

aarch64: openssl-1.0.1e-60.el7_3.1.aarch64.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.aarch64.rpm openssl-devel-1.0.1e-60.el7_3.1.aarch64.rpm openssl-libs-1.0.1e-60.el7_3.1.aarch64.rpm

ppc64: openssl-1.0.1e-60.el7_3.1.ppc64.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.ppc.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.ppc64.rpm openssl-devel-1.0.1e-60.el7_3.1.ppc.rpm openssl-devel-1.0.1e-60.el7_3.1.ppc64.rpm openssl-libs-1.0.1e-60.el7_3.1.ppc.rpm openssl-libs-1.0.1e-60.el7_3.1.ppc64.rpm

ppc64le: openssl-1.0.1e-60.el7_3.1.ppc64le.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.ppc64le.rpm openssl-devel-1.0.1e-60.el7_3.1.ppc64le.rpm openssl-libs-1.0.1e-60.el7_3.1.ppc64le.rpm

s390x: openssl-1.0.1e-60.el7_3.1.s390x.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.s390.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.s390x.rpm openssl-devel-1.0.1e-60.el7_3.1.s390.rpm openssl-devel-1.0.1e-60.el7_3.1.s390x.rpm openssl-libs-1.0.1e-60.el7_3.1.s390.rpm openssl-libs-1.0.1e-60.el7_3.1.s390x.rpm

x86_64: openssl-1.0.1e-60.el7_3.1.x86_64.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm openssl-devel-1.0.1e-60.el7_3.1.i686.rpm openssl-devel-1.0.1e-60.el7_3.1.x86_64.rpm openssl-libs-1.0.1e-60.el7_3.1.i686.rpm openssl-libs-1.0.1e-60.el7_3.1.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

aarch64: openssl-debuginfo-1.0.1e-60.el7_3.1.aarch64.rpm openssl-perl-1.0.1e-60.el7_3.1.aarch64.rpm openssl-static-1.0.1e-60.el7_3.1.aarch64.rpm

ppc64: openssl-debuginfo-1.0.1e-60.el7_3.1.ppc.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.ppc64.rpm openssl-perl-1.0.1e-60.el7_3.1.ppc64.rpm openssl-static-1.0.1e-60.el7_3.1.ppc.rpm openssl-static-1.0.1e-60.el7_3.1.ppc64.rpm

ppc64le: openssl-debuginfo-1.0.1e-60.el7_3.1.ppc64le.rpm openssl-perl-1.0.1e-60.el7_3.1.ppc64le.rpm openssl-static-1.0.1e-60.el7_3.1.ppc64le.rpm

s390x: openssl-debuginfo-1.0.1e-60.el7_3.1.s390.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.s390x.rpm openssl-perl-1.0.1e-60.el7_3.1.s390x.rpm openssl-static-1.0.1e-60.el7_3.1.s390.rpm openssl-static-1.0.1e-60.el7_3.1.s390x.rpm

x86_64: openssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm openssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm openssl-perl-1.0.1e-60.el7_3.1.x86_64.rpm openssl-static-1.0.1e-60.el7_3.1.i686.rpm openssl-static-1.0.1e-60.el7_3.1.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source: openssl-1.0.1e-60.el7_3.1.src.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2016-8610 https://access.redhat.com/security/cve/CVE-2017-3731 https://access.redhat.com/security/updates/classification/#moderate https://www.openssl.org/news/secadv/20170126.txt

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iD8DBQFYqs1TXlSAg2UNWIIRAt7bAJ0ZCDFTFcNP3/qrBxA46aRJQAvxkACaA9Ak 1zK4rWazcUYTZw5zQhD4SXA= =I+Z7 -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.

Security Fix(es):

A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304)
It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. (CVE-2016-0736)
It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. (CVE-2016-2161)
A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys. (CVE-2016-8610)
It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)
A vulnerability was found in httpd's handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. (CVE-2016-8740)

Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304. After installing the updated packages, the httpd daemon will be restarted automatically. Bugs fixed (https://bugzilla.redhat.com/):

1377600 - CVE-2016-6304 openssl: OCSP Status Request extension unbounded memory growth 1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS 1401528 - CVE-2016-8740 httpd: Incomplete handling of LimitRequestFields directive in mod_http2 1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto 1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest 1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects 1412120 - CVE-2016-7056 openssl: ECDSA P-256 timing attack key recovery

JIRA issues fixed (https://issues.jboss.org/):

JBCS-319 - Errata for httpd 2.4.23 SP1 RHEL 7

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)

A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. Solution:

Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

CVE-2016-8610

It was discovered that no limit was imposed on alert packets during
an SSL handshake.

CVE-2017-3731

Robert Swiecki discovered that the RC4-MD5 cipher when running on
32 bit systems could be forced into an out-of-bounds read, resulting
in denial of service.

For the stable distribution (jessie), these problems have been fixed in version 1.0.1t-1+deb8u6.

For the unstable distribution (sid), these problems have been fixed in version 1.1.0d-1 of the openssl source package and in version 1.0.2k-1 of the openssl1.0 source package.

We recommend that you upgrade your openssl packages. 6) - i386, x86_64

The following packages have been upgraded to a later upstream version: gnutls (2.12.23). (CVE-2016-8610)

Multiple flaws were found in the way gnutls processed OpenPGP certificates. An attacker could create specially crafted OpenPGP certificates which, when parsed by gnutls, would cause it to crash. Bugs fixed (https://bugzilla.redhat.com/):

1320982 - ASSERT failure in gnutls-cli-debug 1321112 - DHE_DSS ciphers don't work with client certificates and OpenSSL using TLSv1.2 1323215 - gnutls-serv --http crashes with client certificates with NSS client 1326073 - GnuTLS prefers SHA-1 signatures in TLSv1.2 1326389 - GnuTLS server does not accept SHA-384 and SHA-512 Certificate Verify signatures despite advertising support for them 1326886 - GnuTLS server rejects connections that do not advertise support for SHA-1 signature algorithms 1327656 - gnutls-serv: closing connection without sending an Alert message 1328205 - gnutls-cli won't send certificates that don't match hashes in Certificate Request 1333521 - Provide ability to set the expected server name in gnutls-serv utility 1335924 - gnutls: Disable TLS connections with less than 1024-bit DH parameters 1337460 - Disable/remove export ciphersuites in GnuTLS 1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS 1411836 - CVE-2017-5337 gnutls: Heap read overflow in read-packet.c 1412235 - CVE-2017-5335 gnutls: Out of memory while parsing crafted OpenPGP certificate 1412236 - CVE-2017-5336 gnutls: Stack overflow in cdk_pk_get_keyid 1415682 - Changes introduced by rebase to 2.12.23 break API and ABI compatibility for some libraries

6.

Ubuntu Security Notice USN-3183-2 March 20, 2017

gnutls26 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 14.04 LTS
Ubuntu 12.04 LTS

Summary:

GnuTLS could be made to hang if it received specially crafted network traffic.

Software Description: - gnutls26: GNU TLS library

Details:

USN-3183-1 fixed CVE-2016-8610 in GnuTLS in Ubuntu 16.04 LTS and Ubuntu 16.10. This update provides the corresponding update for Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.

Original advisory details:

Stefan Buehler discovered that GnuTLS incorrectly verified the serial length of OCSP responses. This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-7444) Shi Lei discovered that GnuTLS incorrectly handled certain warning alerts. This issue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610) It was discovered that GnuTLS incorrectly decoded X.509 certificates with a Proxy Certificate Information extension. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5334) It was discovered that GnuTLS incorrectly handled certain OpenPGP certificates. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 LTS: libgnutls26 2.12.23-12ubuntu2.7

Ubuntu 12.04 LTS: libgnutls26 2.12.14-5ubuntu3.14

In general, a standard system update will make all the necessary changes

Show details on source website

JSON

To clipboard

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "openssl",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "openssl",
        "version": "1.0.1"
      },
      {
        "_id": null,
        "model": "openssl",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "enterprise linux workstation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "snapcenter server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "_id": null,
        "model": "m12-1",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3000"
      },
      {
        "_id": null,
        "model": "m10-4s",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3000"
      },
      {
        "_id": null,
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "_id": null,
        "model": "data ontap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "jboss enterprise application platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0.0"
      },
      {
        "_id": null,
        "model": "e-series santricity os controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "netapp",
        "version": "11.40"
      },
      {
        "_id": null,
        "model": "smi-s provider",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "_id": null,
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "_id": null,
        "model": "enterprise linux workstation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "enterprise linux server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "_id": null,
        "model": "e-series santricity os controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "netapp",
        "version": "11.0"
      },
      {
        "_id": null,
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.3"
      },
      {
        "_id": null,
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.3"
      },
      {
        "_id": null,
        "model": "oncommand unified manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "m12-2s",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3000"
      },
      {
        "_id": null,
        "model": "enterprise linux server eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.3"
      },
      {
        "_id": null,
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "_id": null,
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "_id": null,
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.6"
      },
      {
        "_id": null,
        "model": "core rdbms",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18c"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "8.0"
      },
      {
        "_id": null,
        "model": "core rdbms",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.0.1"
      },
      {
        "_id": null,
        "model": "clustered data ontap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "m10-4",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3000"
      },
      {
        "_id": null,
        "model": "enterprise linux server eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.4"
      },
      {
        "_id": null,
        "model": "cn1610",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "_id": null,
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.1.0"
      },
      {
        "_id": null,
        "model": "adaptive access manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.2.3.0"
      },
      {
        "_id": null,
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "_id": null,
        "model": "peoplesoft enterprise peopletools",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.58"
      },
      {
        "_id": null,
        "model": "storagegrid webscale",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "_id": null,
        "model": "jd edwards enterpriseone tools",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.2"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "paloaltonetworks",
        "version": "7.1.0"
      },
      {
        "_id": null,
        "model": "openssl",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2h"
      },
      {
        "_id": null,
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.6"
      },
      {
        "_id": null,
        "model": "data ontap edge",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "_id": null,
        "model": "enterprise linux desktop",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "paloaltonetworks",
        "version": "7.1.10"
      },
      {
        "_id": null,
        "model": "enterprise linux server eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.6"
      },
      {
        "_id": null,
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "_id": null,
        "model": "enterprise linux server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "jboss enterprise application platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.4.0"
      },
      {
        "_id": null,
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.3.6.0.0"
      },
      {
        "_id": null,
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.4.0"
      },
      {
        "_id": null,
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "_id": null,
        "model": "peoplesoft enterprise peopletools",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.57"
      },
      {
        "_id": null,
        "model": "oncommand balance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "enterprise linux server eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.5"
      },
      {
        "_id": null,
        "model": "storagegrid",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3"
      },
      {
        "_id": null,
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.3"
      },
      {
        "_id": null,
        "model": "m10-1",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3000"
      },
      {
        "_id": null,
        "model": "timesten in-memory database",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.1.4.1.0"
      },
      {
        "_id": null,
        "model": "openssl",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2"
      },
      {
        "_id": null,
        "model": "communications ip service activator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.4.0"
      },
      {
        "_id": null,
        "model": "goldengate application adapters",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.2.1.0"
      },
      {
        "_id": null,
        "model": "clustered data ontap antivirus connector",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "_id": null,
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "_id": null,
        "model": "core rdbms",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19c"
      },
      {
        "_id": null,
        "model": "communications analytics",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.1"
      },
      {
        "_id": null,
        "model": "enterprise linux desktop",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.4"
      },
      {
        "_id": null,
        "model": "m12-2",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3000"
      },
      {
        "_id": null,
        "model": "ontap select deploy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "_id": null,
        "model": "host agent",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "core rdbms",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.0.2"
      },
      {
        "_id": null,
        "model": "snapdrive",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "communications ip service activator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.4"
      },
      {
        "_id": null,
        "model": "service processor",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "paloaltonetworks",
        "version": "7.0.0"
      },
      {
        "_id": null,
        "model": "core rdbms",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.2.0.4"
      },
      {
        "_id": null,
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "paloaltonetworks",
        "version": "7.0.15"
      },
      {
        "_id": null,
        "model": "oncommand workflow automation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "paloaltonetworks",
        "version": "6.1.17"
      },
      {
        "_id": null,
        "model": "peoplesoft enterprise peopletools",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.56"
      },
      {
        "_id": null,
        "model": "openssl",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "openssl",
        "version": "1.0.2b"
      },
      {
        "_id": null,
        "model": "openssl",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "openssl",
        "version": "1.0.2"
      },
      {
        "_id": null,
        "model": "openssl",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "openssl",
        "version": "1.0.2a"
      },
      {
        "_id": null,
        "model": "openssl",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "openssl",
        "version": "1.0.2c"
      },
      {
        "_id": null,
        "model": "openssl",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "openssl",
        "version": "1.0.2d"
      },
      {
        "_id": null,
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "16.10"
      },
      {
        "_id": null,
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "16.04"
      },
      {
        "_id": null,
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "14.04"
      },
      {
        "_id": null,
        "model": "linux lts i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "_id": null,
        "model": "linux lts amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "_id": null,
        "model": "jboss web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "0"
      },
      {
        "_id": null,
        "model": "jboss core services on rhel server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "70"
      },
      {
        "_id": null,
        "model": "jboss core services on rhel server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "60"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.1"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.15"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.14"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.13"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.12"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.11"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.10"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.5"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.4"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.1"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.9"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.8"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.7"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "6.1"
      },
      {
        "_id": null,
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7"
      },
      {
        "_id": null,
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "1.1"
      },
      {
        "_id": null,
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "1.0.2"
      },
      {
        "_id": null,
        "model": "project openssl k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl j",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl i",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl h",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl e",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl d",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl c",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl a",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl 1.0.2h",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.2g",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.2f",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.2e",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.2d",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.2c",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.2b",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.2a",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1u",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1t",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1s",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1r",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1q",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1p",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1o",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1n",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1m",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1l",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1k",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1j",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1i",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1h",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1g",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1f",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1e",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1d",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1c",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1b",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.1a",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "1.0.1"
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8zh",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8zg",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8zf",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8ze",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8zd",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8zc",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8zb",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8za",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8y",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8x"
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8w",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8u",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8t",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8s",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8r",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8q",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8p",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8o",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8n",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8m",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8l",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8g",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 0.9.8f",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl f",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "_id": null,
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8v"
      },
      {
        "_id": null,
        "model": "vios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "2.2"
      },
      {
        "_id": null,
        "model": "sterling connect:direct for unix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.1"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.4.4"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.4.3"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.4.8.0"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.4.6.0"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.9.0"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.8.0"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.7.0"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.6.0"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.3"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.2.0"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.10.0"
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "4.2.0.0"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.2.1"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.2.0"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.1.3"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.1.2"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.1.1"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.1.0"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0.4"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0.3"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0.2"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0.1"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0.0"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.9"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.8"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.6"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.5"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.4"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.3"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.2"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.10"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.1"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.0"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.9"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.8"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.7"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.6"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.5"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.13"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.12"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.11"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.10"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.0"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.9"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.8"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.16"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.15"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.14"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.13"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.12"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.11"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.10"
      },
      {
        "_id": null,
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2"
      },
      {
        "_id": null,
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1"
      },
      {
        "_id": null,
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1"
      },
      {
        "_id": null,
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3"
      },
      {
        "_id": null,
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "linux s/390",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "linux mips",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "linux ia-64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "linux ia-32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "_id": null,
        "model": "centos",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "centos",
        "version": "6"
      },
      {
        "_id": null,
        "model": "pan-os",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "paloaltonetworks",
        "version": "7.0.16"
      },
      {
        "_id": null,
        "model": "project openssl 1.1.0b",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "project openssl 1.0.2j",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "_id": null,
        "model": "sterling connect:direct for unix 4.1.0.4.ifix085",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": null
      },
      {
        "_id": null,
        "model": "netezza host management",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.4.9.0"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.2.2"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.1.4"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.5.0.5"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.0.11"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.0.14"
      },
      {
        "_id": null,
        "model": "datapower gateways",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.0.0.17"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "93841"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-8610"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Shi Lei from Gear Team, Qihoo 360 Inc.",
    "sources": [
      {
        "db": "BID",
        "id": "93841"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2016-8610",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2016-8610",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.1,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-97430",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2016-8610",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-8610",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201610-726",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-97430",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2016-8610",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-97430"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-8610"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-8610"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. OpenSSL is prone to denial-of-service vulnerability. \nSuccessful exploitation of the issue will cause excessive memory or CPU resource consumption, resulting in a denial-of-service condition. It supports a variety of encryption algorithms, including symmetric ciphers, hash algorithms, security hashing algorithm, etc. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Moderate: openssl security update\nAdvisory ID:       RHSA-2017:0286-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://rhn.redhat.com/errata/RHSA-2017-0286.html\nIssue date:        2017-02-20\nCVE Names:         CVE-2016-8610 CVE-2017-3731 \n=====================================================================\n\n1. Summary:\n\nAn update for openssl is now available for Red Hat Enterprise Linux 6 and\nRed Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Desktop (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64\nRed Hat Enterprise Linux HPC Node (v. 6) - x86_64\nRed Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64\nRed Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\n\n3. Description:\n\nOpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and\nTransport Layer Security (TLS) protocols, as well as a full-strength\ngeneral-purpose cryptography library. \n\nSecurity Fix(es):\n\n* An integer underflow leading to an out of bounds read flaw was found in\nOpenSSL. \n(CVE-2016-8610)\n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library\nmust be restarted, or the system rebooted. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS\n1416852 - CVE-2017-3731 openssl: Truncated packet could crash via OOB read\n\n6. Package List:\n\nRed Hat Enterprise Linux Desktop (v. 6):\n\nSource:\nopenssl-1.0.1e-48.el6_8.4.src.rpm\n\ni386:\nopenssl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\n\nx86_64:\nopenssl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm\n\nRed Hat Enterprise Linux Desktop Optional (v. 6):\n\ni386:\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-perl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-static-1.0.1e-48.el6_8.4.i686.rpm\n\nx86_64:\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-perl-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-static-1.0.1e-48.el6_8.4.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node (v. 6):\n\nSource:\nopenssl-1.0.1e-48.el6_8.4.src.rpm\n\nx86_64:\nopenssl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm\n\nRed Hat Enterprise Linux HPC Node Optional (v. 6):\n\nx86_64:\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-perl-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-static-1.0.1e-48.el6_8.4.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\nopenssl-1.0.1e-48.el6_8.4.src.rpm\n\ni386:\nopenssl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.i686.rpm\n\nppc64:\nopenssl-1.0.1e-48.el6_8.4.ppc.rpm\nopenssl-1.0.1e-48.el6_8.4.ppc64.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.ppc.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.ppc64.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.ppc.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.ppc64.rpm\n\ns390x:\nopenssl-1.0.1e-48.el6_8.4.s390.rpm\nopenssl-1.0.1e-48.el6_8.4.s390x.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.s390.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.s390x.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.s390.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.s390x.rpm\n\nx86_64:\nopenssl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 6):\n\ni386:\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-perl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-static-1.0.1e-48.el6_8.4.i686.rpm\n\nppc64:\nopenssl-debuginfo-1.0.1e-48.el6_8.4.ppc64.rpm\nopenssl-perl-1.0.1e-48.el6_8.4.ppc64.rpm\nopenssl-static-1.0.1e-48.el6_8.4.ppc64.rpm\n\ns390x:\nopenssl-debuginfo-1.0.1e-48.el6_8.4.s390x.rpm\nopenssl-perl-1.0.1e-48.el6_8.4.s390x.rpm\nopenssl-static-1.0.1e-48.el6_8.4.s390x.rpm\n\nx86_64:\nopenssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-perl-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-static-1.0.1e-48.el6_8.4.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nopenssl-1.0.1e-48.el6_8.4.src.rpm\n\ni386:\nopenssl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.i686.rpm\n\nx86_64:\nopenssl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-devel-1.0.1e-48.el6_8.4.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 6):\n\ni386:\nopenssl-debuginfo-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-perl-1.0.1e-48.el6_8.4.i686.rpm\nopenssl-static-1.0.1e-48.el6_8.4.i686.rpm\n\nx86_64:\nopenssl-debuginfo-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-perl-1.0.1e-48.el6_8.4.x86_64.rpm\nopenssl-static-1.0.1e-48.el6_8.4.x86_64.rpm\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nopenssl-1.0.1e-60.el7_3.1.src.rpm\n\nx86_64:\nopenssl-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nopenssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-perl-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-static-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-static-1.0.1e-60.el7_3.1.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nopenssl-1.0.1e-60.el7_3.1.src.rpm\n\nx86_64:\nopenssl-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nx86_64:\nopenssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-perl-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-static-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-static-1.0.1e-60.el7_3.1.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nopenssl-1.0.1e-60.el7_3.1.src.rpm\n\naarch64:\nopenssl-1.0.1e-60.el7_3.1.aarch64.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.aarch64.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.aarch64.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.aarch64.rpm\n\nppc64:\nopenssl-1.0.1e-60.el7_3.1.ppc64.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.ppc.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.ppc64.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.ppc.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.ppc64.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.ppc.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.ppc64.rpm\n\nppc64le:\nopenssl-1.0.1e-60.el7_3.1.ppc64le.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.ppc64le.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.ppc64le.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.ppc64le.rpm\n\ns390x:\nopenssl-1.0.1e-60.el7_3.1.s390x.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.s390.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.s390x.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.s390.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.s390x.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.s390.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.s390x.rpm\n\nx86_64:\nopenssl-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\naarch64:\nopenssl-debuginfo-1.0.1e-60.el7_3.1.aarch64.rpm\nopenssl-perl-1.0.1e-60.el7_3.1.aarch64.rpm\nopenssl-static-1.0.1e-60.el7_3.1.aarch64.rpm\n\nppc64:\nopenssl-debuginfo-1.0.1e-60.el7_3.1.ppc.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.ppc64.rpm\nopenssl-perl-1.0.1e-60.el7_3.1.ppc64.rpm\nopenssl-static-1.0.1e-60.el7_3.1.ppc.rpm\nopenssl-static-1.0.1e-60.el7_3.1.ppc64.rpm\n\nppc64le:\nopenssl-debuginfo-1.0.1e-60.el7_3.1.ppc64le.rpm\nopenssl-perl-1.0.1e-60.el7_3.1.ppc64le.rpm\nopenssl-static-1.0.1e-60.el7_3.1.ppc64le.rpm\n\ns390x:\nopenssl-debuginfo-1.0.1e-60.el7_3.1.s390.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.s390x.rpm\nopenssl-perl-1.0.1e-60.el7_3.1.s390x.rpm\nopenssl-static-1.0.1e-60.el7_3.1.s390.rpm\nopenssl-static-1.0.1e-60.el7_3.1.s390x.rpm\n\nx86_64:\nopenssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-perl-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-static-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-static-1.0.1e-60.el7_3.1.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nopenssl-1.0.1e-60.el7_3.1.src.rpm\n\nx86_64:\nopenssl-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-devel-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-libs-1.0.1e-60.el7_3.1.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nopenssl-debuginfo-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-debuginfo-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-perl-1.0.1e-60.el7_3.1.x86_64.rpm\nopenssl-static-1.0.1e-60.el7_3.1.i686.rpm\nopenssl-static-1.0.1e-60.el7_3.1.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2016-8610\nhttps://access.redhat.com/security/cve/CVE-2017-3731\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://www.openssl.org/news/secadv/20170126.txt\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2017 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFYqs1TXlSAg2UNWIIRAt7bAJ0ZCDFTFcNP3/qrBxA46aRJQAvxkACaA9Ak\n1zK4rWazcUYTZw5zQhD4SXA=\n=I+Z7\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. This software, such as Apache HTTP Server, is\ncommon to multiple JBoss middleware products, and is packaged under Red Hat\nJBoss Core Services to allow for faster distribution of updates, and for a\nmore consistent update experience. \n\nSecurity Fix(es):\n\n* A memory leak flaw was found in the way OpenSSL handled TLS status\nrequest extension data during session renegotiation. A remote attacker\ncould cause a TLS server using OpenSSL to consume an excessive amount of\nmemory and, possibly, exit unexpectedly after exhausting all available\nmemory, if it enabled OCSP stapling support. (CVE-2016-6304)\n\n* It was discovered that the mod_session_crypto module of httpd did not use\nany mechanisms to verify integrity of the encrypted session data stored in\nthe user\u0027s browser. (CVE-2016-0736)\n\n* It was discovered that the mod_auth_digest module of httpd did not\nproperly check for memory allocation failures. (CVE-2016-2161)\n\n* A timing attack flaw was found in OpenSSL that could allow a malicious\nuser with local access to recover ECDSA P-256 private keys. \n(CVE-2016-8610)\n\n* It was discovered that the HTTP parser in httpd incorrectly allowed\ncertain characters not permitted by the HTTP protocol specification to\nappear unencoded in HTTP request headers. If httpd was used in conjunction\nwith a proxy or backend server that interpreted those characters\ndifferently, a remote attacker could possibly use this flaw to inject data\ninto HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)\n\n* A vulnerability was found in httpd\u0027s handling of the LimitRequestFields\ndirective in mod_http2, affecting servers with HTTP/2 enabled. (CVE-2016-8740)\n\nRed Hat would like to thank the OpenSSL project for reporting CVE-2016-6304\nand Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. \nUpstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original\nreporter of CVE-2016-6304. After installing the updated\npackages, the httpd daemon will be restarted automatically. Bugs fixed (https://bugzilla.redhat.com/):\n\n1377600 - CVE-2016-6304 openssl: OCSP Status Request extension unbounded memory growth\n1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS\n1401528 - CVE-2016-8740 httpd: Incomplete handling of LimitRequestFields directive in mod_http2\n1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto\n1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest\n1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects\n1412120 - CVE-2016-7056 openssl: ECDSA P-256 timing attack key recovery\n\n6. JIRA issues fixed (https://issues.jboss.org/):\n\nJBCS-319 - Errata for httpd 2.4.23 SP1 RHEL 7\n\n7. \n\nApache Tomcat is a servlet container for the Java Servlet and JavaServer\nPages (JSP) technologies. If sendfile processing completed quickly, it was\npossible for the Processor to be added to the processor cache twice. This\ncould lead to invalid responses or information disclosure. (CVE-2017-5647)\n\n* A vulnerability was discovered in the error page mechanism in Tomcat\u0027s\nDefaultServlet implementation. A crafted HTTP request could cause undesired\nside effects, possibly including the removal or replacement of the custom\nerror page. Solution:\n\nBefore applying the update, back up your existing Red Hat JBoss Web Server\ninstallation (including all applications and configuration files). \n\nCVE-2016-8610\n\n    It was discovered that no limit was imposed on alert packets during\n    an SSL handshake. \n\nCVE-2017-3731\n\n    Robert Swiecki discovered that the RC4-MD5 cipher when running on\n    32 bit systems could be forced into an out-of-bounds read, resulting\n    in denial of service. \n\nFor the stable distribution (jessie), these problems have been fixed in\nversion 1.0.1t-1+deb8u6. \n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.1.0d-1 of the openssl source package and in version 1.0.2k-1\nof the openssl1.0 source package. \n\nWe recommend that you upgrade your openssl packages. 6) - i386, x86_64\n\n3. \n\nThe following packages have been upgraded to a later upstream version:\ngnutls (2.12.23). \n(CVE-2016-8610)\n\n* Multiple flaws were found in the way gnutls processed OpenPGP\ncertificates. An attacker could create specially crafted OpenPGP\ncertificates which, when parsed by gnutls, would cause it to crash. Bugs fixed (https://bugzilla.redhat.com/):\n\n1320982 - ASSERT failure in gnutls-cli-debug\n1321112 - DHE_DSS ciphers don\u0027t work with client certificates and OpenSSL using TLSv1.2\n1323215 - gnutls-serv --http crashes with client certificates with NSS client\n1326073 - GnuTLS prefers SHA-1 signatures in TLSv1.2\n1326389 - GnuTLS server does not accept SHA-384 and SHA-512 Certificate Verify signatures despite advertising support for them\n1326886 - GnuTLS server rejects connections that do not advertise support for SHA-1 signature algorithms\n1327656 - gnutls-serv: closing connection without sending an Alert message\n1328205 - gnutls-cli won\u0027t send certificates that don\u0027t match hashes in Certificate Request\n1333521 - Provide ability to set the expected server name in gnutls-serv utility\n1335924 - gnutls: Disable TLS connections with less than 1024-bit DH parameters\n1337460 - Disable/remove export ciphersuites in GnuTLS\n1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS\n1411836 - CVE-2017-5337 gnutls: Heap read overflow in read-packet.c\n1412235 - CVE-2017-5335 gnutls: Out of memory while parsing crafted OpenPGP certificate\n1412236 - CVE-2017-5336 gnutls: Stack overflow in cdk_pk_get_keyid\n1415682 - Changes introduced by rebase to 2.12.23 break API and ABI compatibility for some libraries\n\n6. \n===========================================================================\nUbuntu Security Notice USN-3183-2\nMarch 20, 2017\n\ngnutls26 vulnerability\n===========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 14.04 LTS\n- Ubuntu 12.04 LTS\n\nSummary:\n\nGnuTLS could be made to hang if it received specially crafted network\ntraffic. \n\nSoftware Description:\n- gnutls26: GNU TLS library\n\nDetails:\n\nUSN-3183-1 fixed CVE-2016-8610 in GnuTLS in Ubuntu 16.04 LTS and Ubuntu\n16.10. This update provides the corresponding update for Ubuntu 12.04 LTS\nand Ubuntu 14.04 LTS. \n\nOriginal advisory details:\n\n Stefan Buehler discovered that GnuTLS incorrectly verified the serial\n length of OCSP responses. This issue only applied\n to Ubuntu 16.04 LTS. (CVE-2016-7444)\n  Shi Lei discovered that GnuTLS incorrectly handled certain warning alerts. This issue has only been addressed in\n Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610)\n  It was discovered that GnuTLS incorrectly decoded X.509 certificates with a\n Proxy Certificate Information extension. This issue only affected Ubuntu 16.04 LTS\n and Ubuntu 16.10. (CVE-2017-5334)\n  It was discovered that GnuTLS incorrectly handled certain OpenPGP\n certificates. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 14.04 LTS:\n  libgnutls26                     2.12.23-12ubuntu2.7\n\nUbuntu 12.04 LTS:\n  libgnutls26                     2.12.14-5ubuntu3.14\n\nIn general, a standard system update will make all the necessary changes",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-8610"
      },
      {
        "db": "BID",
        "id": "93841"
      },
      {
        "db": "VULHUB",
        "id": "VHN-97430"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-8610"
      },
      {
        "db": "PACKETSTORM",
        "id": "141173"
      },
      {
        "db": "PACKETSTORM",
        "id": "142848"
      },
      {
        "db": "PACKETSTORM",
        "id": "143874"
      },
      {
        "db": "PACKETSTORM",
        "id": "140781"
      },
      {
        "db": "PACKETSTORM",
        "id": "141752"
      },
      {
        "db": "PACKETSTORM",
        "id": "141708"
      },
      {
        "db": "PACKETSTORM",
        "id": "140890"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-8610",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "93841",
        "trust": 2.1
      },
      {
        "db": "SECTRACK",
        "id": "1037084",
        "trust": 1.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.2173",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "141173",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "141752",
        "trust": 0.2
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-92490",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-97430",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-8610",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "142848",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "143874",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "140781",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "141708",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "140890",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-97430"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-8610"
      },
      {
        "db": "BID",
        "id": "93841"
      },
      {
        "db": "PACKETSTORM",
        "id": "141173"
      },
      {
        "db": "PACKETSTORM",
        "id": "142848"
      },
      {
        "db": "PACKETSTORM",
        "id": "143874"
      },
      {
        "db": "PACKETSTORM",
        "id": "140781"
      },
      {
        "db": "PACKETSTORM",
        "id": "141752"
      },
      {
        "db": "PACKETSTORM",
        "id": "141708"
      },
      {
        "db": "PACKETSTORM",
        "id": "140890"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-8610"
      }
    ]
  },
  "id": "VAR-201711-0007",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-97430"
      }
    ],
    "trust": 0.40555555
  },
  "last_update_date": "2026-03-09T20:19:58.494000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "OpenSSL Remediation measures for denial of service vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=65089"
      },
      {
        "title": "Red Hat: Moderate: openssl security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20170286 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 6.4.16 natives update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20171659 - Security Advisory"
      },
      {
        "title": "Red Hat: Moderate: gnutls security, bug fix, and enhancement update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20170574 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 6.4.16 natives update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20171658 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 6",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20171414 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20171415 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20171413 - Security Advisory"
      },
      {
        "title": "Debian Security Advisories: DSA-3773-1 openssl -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=9f660812dd6a423f7e72aa57751d0031"
      },
      {
        "title": "Red Hat: CVE-2016-8610",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2016-8610"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2017-803",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2017-803"
      },
      {
        "title": "Ubuntu Security Notice: gnutls26 vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3183-2"
      },
      {
        "title": "Ubuntu Security Notice: gnutls26, gnutls28 vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3183-1"
      },
      {
        "title": "Ubuntu Security Notice: openssl vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3181-1"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20171801 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Red Hat JBoss Web Server Service Pack 1 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20171802 - Security Advisory"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2017-815",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2017-815"
      },
      {
        "title": "Oracle Linux Bulletins: Oracle Linux Bulletin - January 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins\u0026qid=ecbe5f193404d1e9c62e8323118ae6cf"
      },
      {
        "title": "Oracle VM Server for x86 Bulletins: Oracle VM Server for x86 Bulletin - January 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_vm_server_for_x86_bulletins\u0026qid=04299a624c15ae57f9f110f484bc5f66"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - October 2016",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=6839c4d3fd328571c675c335d58b5591"
      },
      {
        "title": "Oracle Linux Bulletins: Oracle Linux Bulletin - April 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins\u0026qid=d78b3379ca364568964f30138964c7e7"
      },
      {
        "title": "Oracle VM Server for x86 Bulletins: Oracle VM Server for x86 Bulletin - April 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_vm_server_for_x86_bulletins\u0026qid=bf8deceb640f4a0fee008855afe6aa85"
      },
      {
        "title": "CVE-2016-8610-PoC",
        "trust": 0.1,
        "url": "https://github.com/cujanovic/CVE-2016-8610-PoC "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2016-8610"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-400",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-399",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-97430"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-8610"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 2.4,
        "url": "http://www.securityfocus.com/bid/93841"
      },
      {
        "trust": 2.1,
        "url": "http://seclists.org/oss-sec/2016/q4/224"
      },
      {
        "trust": 1.9,
        "url": "http://rhn.redhat.com/errata/rhsa-2017-0286.html"
      },
      {
        "trust": 1.9,
        "url": "http://rhn.redhat.com/errata/rhsa-2017-0574.html"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2017:1413"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2017:2493"
      },
      {
        "trust": 1.8,
        "url": "http://www.securitytracker.com/id/1037084"
      },
      {
        "trust": 1.8,
        "url": "https://www.debian.org/security/2017/dsa-3773"
      },
      {
        "trust": 1.8,
        "url": "https://security.freebsd.org/advisories/freebsd-sa-16:35.openssl.asc"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2017:1414"
      },
      {
        "trust": 1.8,
        "url": "http://rhn.redhat.com/errata/rhsa-2017-1415.html"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2017:1658"
      },
      {
        "trust": 1.8,
        "url": "http://rhn.redhat.com/errata/rhsa-2017-1659.html"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2017:1801"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2017:1802"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2017:2494"
      },
      {
        "trust": 1.8,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2016-8610"
      },
      {
        "trust": 1.8,
        "url": "https://git.openssl.org/gitweb/?p=openssl.git%3ba=commit%3bh=af58be768ebb690f78530f796e92b8ae5c9a4401"
      },
      {
        "trust": 1.8,
        "url": "https://security.360.cn/cve/cve-2016-8610/"
      },
      {
        "trust": 1.8,
        "url": "https://security.netapp.com/advisory/ntap-20171130-0001/"
      },
      {
        "trust": 1.8,
        "url": "https://security.paloaltonetworks.com/cve-2016-8610"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
      },
      {
        "trust": 1.7,
        "url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbhf03897en_us"
      },
      {
        "trust": 0.9,
        "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=af58be768ebb690f78530f796e92b8ae5c9a4401"
      },
      {
        "trust": 0.9,
        "url": "https://securityadvisories.paloaltonetworks.com/home/detail/87"
      },
      {
        "trust": 0.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-8610"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.2173/"
      },
      {
        "trust": 0.4,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2016-8610"
      },
      {
        "trust": 0.4,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.3,
        "url": "http://openssl.org/"
      },
      {
        "trust": 0.3,
        "url": "http://aix.software.ibm.com/aix/efixes/security/openssl_advisory22.asc"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21994867"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21996760"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21997209"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3731"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7056"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2016-6304"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6304"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5337"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5336"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5335"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5334"
      },
      {
        "trust": 0.2,
        "url": "http://www.ubuntu.com/usn/usn-3183-1"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7444"
      },
      {
        "trust": 0.1,
        "url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-hpesbhf03897en_us"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/400.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/cujanovic/cve-2016-8610-poc"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=49575"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/3183-2/"
      },
      {
        "trust": 0.1,
        "url": "https://www.openssl.org/news/secadv/20170126.txt"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-3731"
      },
      {
        "trust": 0.1,
        "url": "https://issues.jboss.org/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-8740"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-0736"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-8743"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-core-services/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-8743"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-2161"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-8740"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-7056"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0736"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-2161"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-5664"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-5647"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5647"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/3155411"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5664"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-5337"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-5336"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/6.9_release_notes/index.html"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/6.9_technical_notes/index.html"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-5335"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/gnutls26/2.12.23-12ubuntu2.7"
      },
      {
        "trust": 0.1,
        "url": "http://www.ubuntu.com/usn/usn-3183-2"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/gnutls26/2.12.14-5ubuntu3.14"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/gnutls28/3.4.10-4ubuntu1.2"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/gnutls26/2.12.23-12ubuntu2.6"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/gnutls28/3.5.3-5ubuntu1.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/gnutls26/2.12.14-5ubuntu3.13"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-97430"
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-8610"
      },
      {
        "db": "BID",
        "id": "93841"
      },
      {
        "db": "PACKETSTORM",
        "id": "141173"
      },
      {
        "db": "PACKETSTORM",
        "id": "142848"
      },
      {
        "db": "PACKETSTORM",
        "id": "143874"
      },
      {
        "db": "PACKETSTORM",
        "id": "140781"
      },
      {
        "db": "PACKETSTORM",
        "id": "141752"
      },
      {
        "db": "PACKETSTORM",
        "id": "141708"
      },
      {
        "db": "PACKETSTORM",
        "id": "140890"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-8610"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-97430",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2016-8610",
        "ident": null
      },
      {
        "db": "BID",
        "id": "93841",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "141173",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "142848",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "143874",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "140781",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "141752",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "141708",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "140890",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2016-8610",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2017-11-13T00:00:00",
        "db": "VULHUB",
        "id": "VHN-97430",
        "ident": null
      },
      {
        "date": "2017-11-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-8610",
        "ident": null
      },
      {
        "date": "2016-10-24T00:00:00",
        "db": "BID",
        "id": "93841",
        "ident": null
      },
      {
        "date": "2017-02-20T22:47:10",
        "db": "PACKETSTORM",
        "id": "141173",
        "ident": null
      },
      {
        "date": "2017-06-07T22:47:57",
        "db": "PACKETSTORM",
        "id": "142848",
        "ident": null
      },
      {
        "date": "2017-08-22T05:29:02",
        "db": "PACKETSTORM",
        "id": "143874",
        "ident": null
      },
      {
        "date": "2017-01-30T16:58:54",
        "db": "PACKETSTORM",
        "id": "140781",
        "ident": null
      },
      {
        "date": "2017-03-21T14:50:40",
        "db": "PACKETSTORM",
        "id": "141752",
        "ident": null
      },
      {
        "date": "2017-03-20T23:36:43",
        "db": "PACKETSTORM",
        "id": "141708",
        "ident": null
      },
      {
        "date": "2017-02-02T02:05:34",
        "db": "PACKETSTORM",
        "id": "140890",
        "ident": null
      },
      {
        "date": "2016-10-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201610-726",
        "ident": null
      },
      {
        "date": "2017-11-13T22:29:00.203000",
        "db": "NVD",
        "id": "CVE-2016-8610",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2023-02-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-97430",
        "ident": null
      },
      {
        "date": "2023-02-12T00:00:00",
        "db": "VULMON",
        "id": "CVE-2016-8610",
        "ident": null
      },
      {
        "date": "2017-08-22T08:11:00",
        "db": "BID",
        "id": "93841",
        "ident": null
      },
      {
        "date": "2023-02-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201610-726",
        "ident": null
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2016-8610",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "141173"
      },
      {
        "db": "PACKETSTORM",
        "id": "141752"
      },
      {
        "db": "PACKETSTORM",
        "id": "141708"
      },
      {
        "db": "PACKETSTORM",
        "id": "140890"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726"
      }
    ],
    "trust": 1.0
  },
  "title": {
    "_id": null,
    "data": "OpenSSL Resource Management Error Vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "_id": null,
    "data": "resource management error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201610-726"
      }
    ],
    "trust": 0.6
  }
}

VAR-201901-1500

Vulnerability from variot - Updated: 2025-12-19 21:42

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. OpenSSH Contains an access control vulnerability.Information may be tampered with. OpenSSH is prone to an access-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. OpenSSH version 7.9 is vulnerable. ========================================================================== Ubuntu Security Notice USN-3885-1 February 07, 2019

openssh vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 18.10
Ubuntu 18.04 LTS
Ubuntu 16.04 LTS
Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in OpenSSH.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10: openssh-client 1:7.7p1-4ubuntu0.2

Ubuntu 18.04 LTS: openssh-client 1:7.6p1-4ubuntu0.2

Ubuntu 16.04 LTS: openssh-client 1:7.2p2-4ubuntu2.7

Ubuntu 14.04 LTS: openssh-client 1:6.6p1-2ubuntu2.12

In general, a standard system update will make all the necessary changes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201903-16

                                       https://security.gentoo.org/

Severity: Normal Title: OpenSSH: Multiple vulnerabilities Date: March 20, 2019 Bugs: #675520, #675522 ID: 201903-16

Synopsis

Multiple vulnerabilities have been found in OpenSSH, the worst of which could allow a remote attacker to gain unauthorized access.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 net-misc/openssh < 7.9_p1-r4 >= 7.9_p1-r4

Description

Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.

Workaround

There is no known workaround at this time.

Resolution

All OpenSSH users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.9_p1-r4"

References

[ 1 ] CVE-2018-20685 https://nvd.nist.gov/vuln/detail/CVE-2018-20685 [ 2 ] CVE-2019-6109 https://nvd.nist.gov/vuln/detail/CVE-2019-6109 [ 3 ] CVE-2019-6110 https://nvd.nist.gov/vuln/detail/CVE-2019-6110 [ 4 ] CVE-2019-6111 https://nvd.nist.gov/vuln/detail/CVE-2019-6111

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/201903-16

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

===================================================================== Red Hat Security Advisory

Synopsis: Moderate: openssh security, bug fix, and enhancement update Advisory ID: RHSA-2019:3702-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:3702 Issue date: 2019-11-05 CVE Names: CVE-2018-20685 CVE-2019-6109 CVE-2019-6111 =====================================================================

Summary:

An update for openssh is now available for Red Hat Enterprise Linux 8.

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

Description:

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

The following packages have been upgraded to a later upstream version: openssh (8.0p1).

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically. 1686065 - SSH connections get closed when time-based rekeyring is used and ClientAliveMaxCount=0 1691045 - Rebase OpenSSH to latest release (8.0p1?) 1707485 - Use high-level API to do signatures 1712436 - MD5 is used when writing password protected PEM 1732424 - ssh-keygen -A fails in FIPS mode because of DSA key 1732449 - rsa-sha2-*-cert-v01@openssh.com host key types are ignored in FIPS despite being in the policy

Package List:

Red Hat Enterprise Linux AppStream (v. 8):

aarch64: openssh-askpass-8.0p1-3.el8.aarch64.rpm openssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-debugsource-8.0p1-3.el8.aarch64.rpm openssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm

ppc64le: openssh-askpass-8.0p1-3.el8.ppc64le.rpm openssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-debugsource-8.0p1-3.el8.ppc64le.rpm openssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm

s390x: openssh-askpass-8.0p1-3.el8.s390x.rpm openssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm openssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm openssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm openssh-debuginfo-8.0p1-3.el8.s390x.rpm openssh-debugsource-8.0p1-3.el8.s390x.rpm openssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm openssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm openssh-server-debuginfo-8.0p1-3.el8.s390x.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm

x86_64: openssh-askpass-8.0p1-3.el8.x86_64.rpm openssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-debugsource-8.0p1-3.el8.x86_64.rpm openssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm

Red Hat Enterprise Linux BaseOS (v. 8):

Source: openssh-8.0p1-3.el8.src.rpm

aarch64: openssh-8.0p1-3.el8.aarch64.rpm openssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-cavs-8.0p1-3.el8.aarch64.rpm openssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-clients-8.0p1-3.el8.aarch64.rpm openssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-debugsource-8.0p1-3.el8.aarch64.rpm openssh-keycat-8.0p1-3.el8.aarch64.rpm openssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-ldap-8.0p1-3.el8.aarch64.rpm openssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-server-8.0p1-3.el8.aarch64.rpm openssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm pam_ssh_agent_auth-0.10.3-7.3.el8.aarch64.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm

ppc64le: openssh-8.0p1-3.el8.ppc64le.rpm openssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-cavs-8.0p1-3.el8.ppc64le.rpm openssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-clients-8.0p1-3.el8.ppc64le.rpm openssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-debugsource-8.0p1-3.el8.ppc64le.rpm openssh-keycat-8.0p1-3.el8.ppc64le.rpm openssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-ldap-8.0p1-3.el8.ppc64le.rpm openssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-server-8.0p1-3.el8.ppc64le.rpm openssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm pam_ssh_agent_auth-0.10.3-7.3.el8.ppc64le.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm

s390x: openssh-8.0p1-3.el8.s390x.rpm openssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm openssh-cavs-8.0p1-3.el8.s390x.rpm openssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm openssh-clients-8.0p1-3.el8.s390x.rpm openssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm openssh-debuginfo-8.0p1-3.el8.s390x.rpm openssh-debugsource-8.0p1-3.el8.s390x.rpm openssh-keycat-8.0p1-3.el8.s390x.rpm openssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm openssh-ldap-8.0p1-3.el8.s390x.rpm openssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm openssh-server-8.0p1-3.el8.s390x.rpm openssh-server-debuginfo-8.0p1-3.el8.s390x.rpm pam_ssh_agent_auth-0.10.3-7.3.el8.s390x.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm

x86_64: openssh-8.0p1-3.el8.x86_64.rpm openssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-cavs-8.0p1-3.el8.x86_64.rpm openssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-clients-8.0p1-3.el8.x86_64.rpm openssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-debugsource-8.0p1-3.el8.x86_64.rpm openssh-keycat-8.0p1-3.el8.x86_64.rpm openssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-ldap-8.0p1-3.el8.x86_64.rpm openssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-server-8.0p1-3.el8.x86_64.rpm openssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm pam_ssh_agent_auth-0.10.3-7.3.el8.x86_64.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2018-20685 https://access.redhat.com/security/cve/CVE-2019-6109 https://access.redhat.com/security/cve/CVE-2019-6111 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iQIVAwUBXcHzKNzjgjWX9erEAQiytQ/6Apphov2V0QmnXA+KO3ZZKBPXtgKv8Sv1 dPtXhTC+Keq4yX9/bXlIuyk6BUsMeaiIMlL5bSSKtq2I7rVxwubTcPX4rD+pQvx8 ArNJgn7U2/3xqwc0R8dNXx6o8vB1M6jXDtu8fKJOxW48evDJf6gE4gX2KUM9yxR2 MhCoHVkLp9a5f0T11yFPI11H0P8gXXQgboAkdt82Ui35T4tD8RndVyPCsllN2c/X QCCbvZ9e8OLJJoxsOryLcw8tpQHXK2AJMXWv0Us99kQtbaBULWWahhrg/tftLxtT pILFBaB/RsmGg1O6OkxJ2CuKl6ATC2Wlj/Z7uYPrS7MQDn+fXkH2gfcjb4Z4rqIL IyKbUpsyFEAaV5rJUeRaS7dGfuQldQbS96P8lUpCcOXPbYD8FgTrW2q3NjOKgYMU +gh2xPwmlRm+iYfmedPoR2+bTWNYv8JS+Cp/fZF4IFx2EJPQcxKLYshNKgcfkNkR rIZ4brUI79p84H01TcTh4mFAbR63Y+c36UAI3/fM/W/RkZn/PdoJtpfwg/tjOYZH rt9kL7SfAEhjHNtBuJGNol6e124srS6300hnfFovAr6llDOcYlrh3ZgVZjVrn6E8 TZhyZ84TGMOqykfH7B9XkJH82X+x3rd2m0ovCPq+Ly62BasdXVd0C2snzbx8OAM8 I+am8dhVlyM= =iPw4 -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . scp client multiple vulnerabilities =================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

Overview

SCP clients from multiple vendors are susceptible to a malicious scp server performing unauthorized changes to target directory and/or client output manipulation.

Description

Many scp clients fail to verify if the objects returned by the scp server match those it asked for. This issue dates back to 1983 and rcp, on which scp is based. Finally, two vulnerabilities in clients may allow server to spoof the client output.

Details

The discovered vulnerabilities, described in more detail below, enables the attack described here in brief.

The attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases file to victim's home directory when the victim performs scp operation from the server. The transfer of extra files is hidden by sending ANSI control sequences via stderr. For example:

user@local:~$ scp user@remote:readme.txt . readme.txt 100% 494 1.6KB/s 00:00 user@local:~$
Once the victim launches a new shell, the malicious commands in .bash_aliases get executed.

*) Man-in-the-Middle attack does require the victim to accept the wrong host fingerprint.

Vulnerabilities

CWE-20: scp client missing received object name validation [CVE-2019-6111]

Due to the scp implementation being derived from 1983 rcp [1], the server chooses which files/directories are sent to the client. However, scp client only perform cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example overwrite .ssh/authorized_keys).

The same vulnerability in WinSCP is known as CVE-2018-20684.

CWE-451: scp client spoofing via object name [CVE-2019-6109]

Due to missing character encoding in the progress display, the object name can be used to manipulate the client output, for example to employ ANSI codes to hide additional files being transferred.

CWE-451: scp client spoofing via stderr [CVE-2019-6110]

Due to accepting and displaying arbitrary stderr output from the scp server, a malicious server can manipulate the client output, for example to employ ANSI codes to hide additional files being transferred.

Proof-of-Concept

Proof of concept malicious scp server will be released at a later date.

Vulnerable versions

The following software packages have some or all vulnerabilities:

                ver      #1  #2  #3  #4

OpenSSH scp <=7.9 x x x x PuTTY PSCP ? - - x x WinSCP scp mode <=5.13 - x - -

Tectia SSH scpg3 is not affected since it exclusively uses sftp protocol.

Mitigation

OpenSSH

1.1 Switch to sftp if possible

1.2 Alternatively apply the following patch to harden scp against most server-side manipulation attempts: https://sintonen.fi/advisories/scp-name-validator.patch

 NOTE: This patch may cause problems if the the remote and local shells don't
 agree on the way glob() pattern matching works. YMMV.

PuTTY

2.1 No fix is available yet

WinSCP

3.1. Upgrade to WinSCP 5.14 or later

Similar or prior work

CVE-2000-0992 - scp overwrites arbitrary files

References

https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access

Credits

The vulnerability was discovered by Harry Sintonen / F-Secure Corporation.

Timeline

2018.08.08 initial discovery of vulnerabilities #1 and #2 2018.08.09 reported vulnerabilities #1 and #2 to OpenSSH 2018.08.10 OpenSSH acknowledged the vulnerabilities 2018.08.14 discovered & reported vulnerability #3 to OpenSSH 2018.08.15 discovered & reported vulnerability #4 to OpenSSH 2018.08.30 reported PSCP vulnerabilities (#3 and #4) to PuTTY developers 2018.08.31 reported WinSCP vulnerability (#2) to WinSCP developers 2018.09.04 WinSCP developers reported the vulnerability #2 fixed 2018.11.12 requested a status update from OpenSSH 2018.11.16 OpenSSH fixed vulnerability #1 2019.01.07 requested a status update from OpenSSH 2019.01.08 requested CVE assignments from MITRE 2019.01.10 received CVE assignments from MITRE 2019.01.11 public disclosure of the advisory 2019.01.14 added a warning about the potential issues caused by the patch

. All the vulnerabilities are in found in the scp client implementing the SCP protocol. The check added in this version can lead to regression if the client and the server have differences in wildcard expansion rules. If the server is trusted for that purpose, the check can be disabled with a new -T option to the scp client.

For the stable distribution (stretch), these problems have been fixed in version 1:7.4p1-10+deb9u5.

For the detailed security status of openssh please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssh

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAlxe0w0ACgkQ3rYcyPpX RFs85AgA0GrSHO4Qf5FVsE3oXa+nMkZ4U6pbOA9dHotX54DEyNuIJrOsOv01cFxQ t2Z6uDkZptmHZT4uSWg2xIgMvpkGo9906ziZfHc0LTuHl8j++7cCDIDGZBm/iZaX ueQfl85gHDpte41JvUtpSBAwk1Bic7ltLUPDIGEiq6nQboxHIzsU7ULVb1l0wNxF sEFDPWGBS01HTa+QWgQaG/wbEhMRDcVz1Ck7dqpT2soQRohDWxU01j14q1EKe9O9 GHiWECvFSHBkkI/v8lNfSWnOWYa/+Aknri0CpjPc/bqh2Yx9rgp/Q5+FJ/FxJjmC bHFd+tbxB1LxEO96zKguYpPIzw7Kcw== =5Fd8 -----END PGP SIGNATURE-----

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201901-1500",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "solaris",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "10"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "16.04"
      },
      {
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "storage automation store",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "scalance x204rna",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.7"
      },
      {
        "model": "winscp",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "winscp",
        "version": "5.13"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.1"
      },
      {
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "cloud backup",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "14.04"
      },
      {
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.10"
      },
      {
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.4"
      },
      {
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "openssh",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "openbsd",
        "version": "7.9"
      },
      {
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.6"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.4"
      },
      {
        "model": "steelstore cloud integrated storage",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.2"
      },
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.4"
      },
      {
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.6"
      },
      {
        "model": "element software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "scalance x204rna eec",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.7"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.6"
      },
      {
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "8.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.2"
      },
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.2"
      },
      {
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "ontap select deploy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "ubuntu",
        "scope": null,
        "trust": 0.8,
        "vendor": "canonical",
        "version": null
      },
      {
        "model": "gnu/linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "debian",
        "version": null
      },
      {
        "model": "element software",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "cloud backup",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "ontap select deploy administration utility",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "steelstore cloud integrated storage",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "storage automation store",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "openbsd",
        "version": "7.9"
      },
      {
        "model": "winscp",
        "scope": null,
        "trust": 0.8,
        "vendor": "winscp",
        "version": null
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.9"
      },
      {
        "model": "traffix sdc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "5.1"
      },
      {
        "model": "traffix sdc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "5.0"
      },
      {
        "model": "traffix sdc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.4"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106531"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-20685"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:canonical:ubuntu_linux",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:debian:debian_linux",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:netapp:element_software",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:netapp:cloud_backup",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:netapp:ontap_select_administration_utility",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:netapp:steelstore_cloud_integrated_storage",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:netapp:storage_automation_store",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:openbsd:openssh",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:winscp:winscp",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat,Harry Sintonen,Gentoo",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2018-20685",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 4.9,
            "id": "CVE-2018-20685",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 1.9,
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 1.6,
            "id": "CVE-2018-20685",
            "impactScore": 3.6,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.3,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2018-20685",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-20685",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2018-20685",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-20685",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201901-347",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-20685",
            "trust": 0.1,
            "value": "LOW"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-20685"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-20685"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-20685"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. OpenSSH Contains an access control vulnerability.Information may be tampered with. OpenSSH is prone to an access-bypass vulnerability. \nAn attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. \nOpenSSH version 7.9 is vulnerable. ==========================================================================\nUbuntu Security Notice USN-3885-1\nFebruary 07, 2019\n\nopenssh vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 18.10\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n- Ubuntu 14.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in OpenSSH. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 18.10:\n  openssh-client                  1:7.7p1-4ubuntu0.2\n\nUbuntu 18.04 LTS:\n  openssh-client                  1:7.6p1-4ubuntu0.2\n\nUbuntu 16.04 LTS:\n  openssh-client                  1:7.2p2-4ubuntu2.7\n\nUbuntu 14.04 LTS:\n  openssh-client                  1:6.6p1-2ubuntu2.12\n\nIn general, a standard system update will make all the necessary changes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201903-16\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: OpenSSH: Multiple vulnerabilities\n     Date: March 20, 2019\n     Bugs: #675520, #675522\n       ID: 201903-16\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in OpenSSH, the worst of which\ncould allow a remote attacker to gain unauthorized access. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  net-misc/openssh           \u003c 7.9_p1-r4              \u003e= 7.9_p1-r4 \n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in OpenSSH. Please review\nthe CVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll OpenSSH users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=net-misc/openssh-7.9_p1-r4\"\n\nReferences\n==========\n\n[ 1 ] CVE-2018-20685\n      https://nvd.nist.gov/vuln/detail/CVE-2018-20685\n[ 2 ] CVE-2019-6109\n      https://nvd.nist.gov/vuln/detail/CVE-2019-6109\n[ 3 ] CVE-2019-6110\n      https://nvd.nist.gov/vuln/detail/CVE-2019-6110\n[ 4 ] CVE-2019-6111\n      https://nvd.nist.gov/vuln/detail/CVE-2019-6111\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201903-16\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2019 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Moderate: openssh security, bug fix, and enhancement update\nAdvisory ID:       RHSA-2019:3702-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2019:3702\nIssue date:        2019-11-05\nCVE Names:         CVE-2018-20685 CVE-2019-6109 CVE-2019-6111 \n=====================================================================\n\n1. Summary:\n\nAn update for openssh is now available for Red Hat Enterprise Linux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. Relevant releases/architectures:\n\nRed Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64\n\n3. Description:\n\nOpenSSH is an SSH protocol implementation supported by a number of Linux,\nUNIX, and similar operating systems. It includes the core files necessary\nfor both the OpenSSH client and server. \n\nThe following packages have been upgraded to a later upstream version:\nopenssh (8.0p1). \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 8.1 Release Notes linked from the References section. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, the OpenSSH server daemon (sshd) will be\nrestarted automatically. \n1686065 - SSH connections get closed when time-based rekeyring is used and ClientAliveMaxCount=0\n1691045 - Rebase OpenSSH to latest release (8.0p1?)\n1707485 - Use high-level API to do signatures\n1712436 - MD5 is used when writing password protected PEM\n1732424 - ssh-keygen -A fails in FIPS mode because of DSA key\n1732449 - rsa-sha2-*-cert-v01@openssh.com host key types are ignored in FIPS despite being in the policy\n\n6. Package List:\n\nRed Hat Enterprise Linux AppStream (v. 8):\n\naarch64:\nopenssh-askpass-8.0p1-3.el8.aarch64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debugsource-8.0p1-3.el8.aarch64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm\n\nppc64le:\nopenssh-askpass-8.0p1-3.el8.ppc64le.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debugsource-8.0p1-3.el8.ppc64le.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm\n\ns390x:\nopenssh-askpass-8.0p1-3.el8.s390x.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debugsource-8.0p1-3.el8.s390x.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.s390x.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm\n\nx86_64:\nopenssh-askpass-8.0p1-3.el8.x86_64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debugsource-8.0p1-3.el8.x86_64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm\n\nRed Hat Enterprise Linux BaseOS (v. 8):\n\nSource:\nopenssh-8.0p1-3.el8.src.rpm\n\naarch64:\nopenssh-8.0p1-3.el8.aarch64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-cavs-8.0p1-3.el8.aarch64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-clients-8.0p1-3.el8.aarch64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debugsource-8.0p1-3.el8.aarch64.rpm\nopenssh-keycat-8.0p1-3.el8.aarch64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-ldap-8.0p1-3.el8.aarch64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-server-8.0p1-3.el8.aarch64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.aarch64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm\n\nppc64le:\nopenssh-8.0p1-3.el8.ppc64le.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-cavs-8.0p1-3.el8.ppc64le.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-clients-8.0p1-3.el8.ppc64le.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debugsource-8.0p1-3.el8.ppc64le.rpm\nopenssh-keycat-8.0p1-3.el8.ppc64le.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-ldap-8.0p1-3.el8.ppc64le.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-server-8.0p1-3.el8.ppc64le.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.ppc64le.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm\n\ns390x:\nopenssh-8.0p1-3.el8.s390x.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-cavs-8.0p1-3.el8.s390x.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-clients-8.0p1-3.el8.s390x.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debugsource-8.0p1-3.el8.s390x.rpm\nopenssh-keycat-8.0p1-3.el8.s390x.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-ldap-8.0p1-3.el8.s390x.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-server-8.0p1-3.el8.s390x.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.s390x.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.s390x.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm\n\nx86_64:\nopenssh-8.0p1-3.el8.x86_64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-cavs-8.0p1-3.el8.x86_64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-clients-8.0p1-3.el8.x86_64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debugsource-8.0p1-3.el8.x86_64.rpm\nopenssh-keycat-8.0p1-3.el8.x86_64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-ldap-8.0p1-3.el8.x86_64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-server-8.0p1-3.el8.x86_64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.x86_64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-20685\nhttps://access.redhat.com/security/cve/CVE-2019-6109\nhttps://access.redhat.com/security/cve/CVE-2019-6111\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2019 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXcHzKNzjgjWX9erEAQiytQ/6Apphov2V0QmnXA+KO3ZZKBPXtgKv8Sv1\ndPtXhTC+Keq4yX9/bXlIuyk6BUsMeaiIMlL5bSSKtq2I7rVxwubTcPX4rD+pQvx8\nArNJgn7U2/3xqwc0R8dNXx6o8vB1M6jXDtu8fKJOxW48evDJf6gE4gX2KUM9yxR2\nMhCoHVkLp9a5f0T11yFPI11H0P8gXXQgboAkdt82Ui35T4tD8RndVyPCsllN2c/X\nQCCbvZ9e8OLJJoxsOryLcw8tpQHXK2AJMXWv0Us99kQtbaBULWWahhrg/tftLxtT\npILFBaB/RsmGg1O6OkxJ2CuKl6ATC2Wlj/Z7uYPrS7MQDn+fXkH2gfcjb4Z4rqIL\nIyKbUpsyFEAaV5rJUeRaS7dGfuQldQbS96P8lUpCcOXPbYD8FgTrW2q3NjOKgYMU\n+gh2xPwmlRm+iYfmedPoR2+bTWNYv8JS+Cp/fZF4IFx2EJPQcxKLYshNKgcfkNkR\nrIZ4brUI79p84H01TcTh4mFAbR63Y+c36UAI3/fM/W/RkZn/PdoJtpfwg/tjOYZH\nrt9kL7SfAEhjHNtBuJGNol6e124srS6300hnfFovAr6llDOcYlrh3ZgVZjVrn6E8\nTZhyZ84TGMOqykfH7B9XkJH82X+x3rd2m0ovCPq+Ly62BasdXVd0C2snzbx8OAM8\nI+am8dhVlyM=\n=iPw4\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. scp client multiple vulnerabilities\n===================================\nThe latest version of this advisory is available at:\nhttps://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt\n\n\nOverview\n--------\n\nSCP clients from multiple vendors are susceptible to a malicious scp server performing\nunauthorized changes to target directory and/or client output manipulation. \n\n\nDescription\n-----------\n\nMany scp clients fail to verify if the objects returned by the scp server match those\nit asked for. This issue dates back to 1983 and rcp, on which scp is based. \nFinally, two vulnerabilities in clients may allow server to spoof the client output. \n\n\nDetails\n-------\n\nThe discovered vulnerabilities, described in more detail below, enables the attack\ndescribed here in brief. \n\n1. The attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases\n    file to victim\u0027s home directory when the victim performs scp operation from the\n    server. The transfer of extra files is hidden by sending ANSI control sequences\n    via stderr. For example:\n\n    user@local:~$ scp user@remote:readme.txt . \n    readme.txt                                         100%  494     1.6KB/s   00:00\n    user@local:~$\n\n2. Once the victim launches a new shell, the malicious commands in .bash_aliases get\n    executed. \n\n\n*) Man-in-the-Middle attack does require the victim to accept the wrong host\n    fingerprint. \n\n\nVulnerabilities\n---------------\n\n1. \n\n\n2. CWE-20: scp client missing received object name validation [CVE-2019-6111]\n\nDue to the scp implementation being derived from 1983 rcp [1], the server chooses which\nfiles/directories are sent to the client. However, scp client only perform cursory\nvalidation of the object name returned (only directory traversal attacks are prevented). \nA malicious scp server can overwrite arbitrary files in the scp client target directory. \nIf recursive operation (-r) is performed, the server can manipulate subdirectories\nas well (for example overwrite .ssh/authorized_keys). \n\nThe same vulnerability in WinSCP is known as CVE-2018-20684. \n\n\n3. CWE-451: scp client spoofing via object name [CVE-2019-6109]\n\nDue to missing character encoding in the progress display, the object name can be used\nto manipulate the client output, for example to employ ANSI codes to hide additional\nfiles being transferred. \n\n\n4. CWE-451: scp client spoofing via stderr [CVE-2019-6110]\n\nDue to accepting and displaying arbitrary stderr output from the scp server, a\nmalicious server can manipulate the client output, for example to employ ANSI codes\nto hide additional files being transferred. \n\n\nProof-of-Concept\n----------------\n\nProof of concept malicious scp server will be released at a later date. \n\n\nVulnerable versions\n-------------------\n\nThe following software packages have some or all vulnerabilities:\n\n                    ver      #1  #2  #3  #4\nOpenSSH scp        \u003c=7.9    x   x   x   x\nPuTTY PSCP         ?        -   -   x   x\nWinSCP scp mode    \u003c=5.13   -   x   -   -\n\nTectia SSH scpg3 is not affected since it exclusively uses sftp protocol. \n\n\nMitigation\n----------\n\n1. OpenSSH\n\n1.1 Switch to sftp if possible\n\n1.2 Alternatively apply the following patch to harden scp against most server-side\n     manipulation attempts: https://sintonen.fi/advisories/scp-name-validator.patch\n\n     NOTE: This patch may cause problems if the the remote and local shells don\u0027t\n     agree on the way glob() pattern matching works. YMMV. \n\n2. PuTTY\n\n2.1 No fix is available yet\n\n3. WinSCP\n\n3.1. Upgrade to WinSCP 5.14 or later\n\n\n\nSimilar or prior work\n---------------------\n\n1. CVE-2000-0992 - scp overwrites arbitrary files\n\n\nReferences\n----------\n\n1. https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access\n\n\nCredits\n-------\n\nThe vulnerability was discovered by Harry Sintonen / F-Secure Corporation. \n\n\nTimeline\n--------\n\n2018.08.08  initial discovery of vulnerabilities #1 and #2\n2018.08.09  reported vulnerabilities #1 and #2 to OpenSSH\n2018.08.10  OpenSSH acknowledged the vulnerabilities\n2018.08.14  discovered \u0026 reported vulnerability #3 to OpenSSH\n2018.08.15  discovered \u0026 reported vulnerability #4 to OpenSSH\n2018.08.30  reported PSCP vulnerabilities (#3 and #4) to PuTTY developers\n2018.08.31  reported WinSCP vulnerability (#2) to WinSCP developers\n2018.09.04  WinSCP developers reported the vulnerability #2 fixed\n2018.11.12  requested a status update from OpenSSH\n2018.11.16  OpenSSH fixed vulnerability #1\n2019.01.07  requested a status update from OpenSSH\n2019.01.08  requested CVE assignments from MITRE\n2019.01.10  received CVE assignments from MITRE\n2019.01.11  public disclosure of the advisory\n2019.01.14  added a warning about the potential issues caused by the patch\n\n\n. All the vulnerabilities\nare in found in the scp client implementing the SCP protocol. \n    The check added in this version can lead to regression if the client and\n    the server have differences in wildcard expansion rules. If the server is\n    trusted for that purpose, the check can be disabled with a new -T option to\n    the scp client. \n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1:7.4p1-10+deb9u5. \n\nFor the detailed security status of openssh please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/openssh\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAlxe0w0ACgkQ3rYcyPpX\nRFs85AgA0GrSHO4Qf5FVsE3oXa+nMkZ4U6pbOA9dHotX54DEyNuIJrOsOv01cFxQ\nt2Z6uDkZptmHZT4uSWg2xIgMvpkGo9906ziZfHc0LTuHl8j++7cCDIDGZBm/iZaX\nueQfl85gHDpte41JvUtpSBAwk1Bic7ltLUPDIGEiq6nQboxHIzsU7ULVb1l0wNxF\nsEFDPWGBS01HTa+QWgQaG/wbEhMRDcVz1Ck7dqpT2soQRohDWxU01j14q1EKe9O9\nGHiWECvFSHBkkI/v8lNfSWnOWYa/+Aknri0CpjPc/bqh2Yx9rgp/Q5+FJ/FxJjmC\nbHFd+tbxB1LxEO96zKguYpPIzw7Kcw==\n=5Fd8\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-20685"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      },
      {
        "db": "BID",
        "id": "106531"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-20685"
      },
      {
        "db": "PACKETSTORM",
        "id": "151577"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "158639"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      }
    ],
    "trust": 2.52
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-20685",
        "trust": 3.4
      },
      {
        "db": "BID",
        "id": "106531",
        "trust": 2.0
      },
      {
        "db": "SIEMENS",
        "id": "SSA-412672",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "152154",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "158639",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1280.2",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1410.2",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.5087",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1280",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0410.3",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.3795",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1410",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.2671",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-347",
        "trust": 0.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-349-21",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-20685",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "151577",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "155158",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "151175",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "151601",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-20685"
      },
      {
        "db": "BID",
        "id": "106531"
      },
      {
        "db": "PACKETSTORM",
        "id": "151577"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "158639"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-20685"
      }
    ]
  },
  "id": "VAR-201901-1500",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.64041158
  },
  "last_update_date": "2025-12-19T21:42:31.515000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "DSA-4387",
        "trust": 0.8,
        "url": "https://www.debian.org/security/2019/dsa-4387"
      },
      {
        "title": "upstream: disallow empty incoming filename or ones that refer to the current directory",
        "trust": 0.8,
        "url": "https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2"
      },
      {
        "title": "NTAP-20190215-0001",
        "trust": 0.8,
        "url": "https://security.netapp.com/advisory/ntap-20190215-0001/"
      },
      {
        "title": "Diff for /src/usr.bin/ssh/scp.c between version 1.197 and 1.198",
        "trust": 0.8,
        "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197\u0026r2=1.198\u0026f=h"
      },
      {
        "title": "USN-3885-1",
        "trust": 0.8,
        "url": "https://usn.ubuntu.com/3885-1/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://winscp.net/eng/index.php"
      },
      {
        "title": "OpenSSH scp Repair measures for client security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=88522"
      },
      {
        "title": "The Register",
        "trust": 0.2,
        "url": "https://www.theregister.co.uk/2019/01/15/scp_vulnerability/"
      },
      {
        "title": "Red Hat: Moderate: openssh security, bug fix, and enhancement update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20193702 - Security Advisory"
      },
      {
        "title": "Ubuntu Security Notice: openssh vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3885-1"
      },
      {
        "title": "Debian CVElist Bug Report Logs: openssh-client: scp can send arbitrary control characters / escape sequences to the terminal (CVE-2019-6109)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=dffe92fd93b8f745f5f15bc2f29dc935"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2018-20685"
      },
      {
        "title": "Arch Linux Advisories: [ASA-201904-11] openssh: multiple issues",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201904-11"
      },
      {
        "title": "Debian CVElist Bug Report Logs: netkit-rsh: CVE-2019-7282 CVE-2019-7283",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=a043554ad34dcb6b0dc285dc8ea3ce0d"
      },
      {
        "title": "Debian CVElist Bug Report Logs: CVE-2019-6111 not fixed, file transfer of unwanted files by malicious SSH server still possible",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=74b791ca4fdf54c27d2b50ef6845ef8e"
      },
      {
        "title": "Debian CVElist Bug Report Logs: openssh: CVE-2018-20685: scp.c in the scp client allows remote SSH servers to bypass intended access restrictions",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=8394bb17731a99ef76b185cbc70acfa3"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2019-1313",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2019-1313"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2019-1216",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2019-1216"
      },
      {
        "title": "IBM: IBM Security Bulletin: Vulnerabilities in OpenSSH affect AIX (CVE-2018-20685 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111) Security Bulletin",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=50a54c2fb43b489f64442dcf4f25bc3b"
      },
      {
        "title": "IBM: IBM Security Bulletin: Vyatta 5600 vRouter Software Patches \u2013 Releases 1801-w and 1801-y",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=bf3f2299a8658b7cd3984c40e7060666"
      },
      {
        "title": "IBM: Security Bulletin: Multiple vulnerabilities affect IBM Cloud Object Storage Systems (February 2020v1)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=979e60202a29c3c55731e37f8ddc5a3b"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=ec6577109e640dac19a6ddb978afe82d"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Live-Hack-CVE/CVE-2018-20685 "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/h4xrOx/Direct-Admin-Vulnerability-Disclosure "
      },
      {
        "title": "DC-4-Vulnhub-Walkthrough",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/DC-4-Vulnhub-Walkthrough "
      },
      {
        "title": "nmap",
        "trust": 0.1,
        "url": "https://github.com/devairdarolt/nmap "
      },
      {
        "title": "github_aquasecurity_trivy",
        "trust": 0.1,
        "url": "https://github.com/back8/github_aquasecurity_trivy "
      },
      {
        "title": "TrivyWeb",
        "trust": 0.1,
        "url": "https://github.com/KorayAgaya/TrivyWeb "
      },
      {
        "title": "Funbox2-rookie",
        "trust": 0.1,
        "url": "https://github.com/vaishali1998/Funbox2-rookie "
      },
      {
        "title": "Vulnerability-Scanner-for-Containers",
        "trust": 0.1,
        "url": "https://github.com/t31m0/Vulnerability-Scanner-for-Containers "
      },
      {
        "title": "security",
        "trust": 0.1,
        "url": "https://github.com/umahari/security "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Mohzeela/external-secret "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/simiyo/trivy "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/aquasecurity/trivy "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/knqyf263/trivy "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/siddharthraopotukuchi/trivy "
      },
      {
        "title": "Basic-Pentesting-2-Vulnhub-Walkthrough",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/Basic-Pentesting-2-Vulnhub-Walkthrough "
      },
      {
        "title": "Basic-Pentesting-2",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/Basic-Pentesting-2 "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-20685"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-863",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-284",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-20685"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.5,
        "url": "http://www.securityfocus.com/bid/106531"
      },
      {
        "trust": 2.6,
        "url": "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt"
      },
      {
        "trust": 2.5,
        "url": "https://access.redhat.com/errata/rhsa-2019:3702"
      },
      {
        "trust": 2.3,
        "url": "https://www.debian.org/security/2019/dsa-4387"
      },
      {
        "trust": 2.0,
        "url": "https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2"
      },
      {
        "trust": 2.0,
        "url": "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197\u0026r2=1.198\u0026f=h"
      },
      {
        "trust": 2.0,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
      },
      {
        "trust": 1.8,
        "url": "https://usn.ubuntu.com/3885-1/"
      },
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/201903-16"
      },
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/202007-53"
      },
      {
        "trust": 1.7,
        "url": "https://security.netapp.com/advisory/ntap-20190215-0001/"
      },
      {
        "trust": 1.7,
        "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20685"
      },
      {
        "trust": 1.4,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2018-20685"
      },
      {
        "trust": 1.0,
        "url": "https://access.redhat.com/security/cve/cve-2018-20685"
      },
      {
        "trust": 0.9,
        "url": "http://www.openssh.org/"
      },
      {
        "trust": 0.9,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1665785"
      },
      {
        "trust": 0.9,
        "url": "https://support.f5.com/csp/article/k11315080"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-20685"
      },
      {
        "trust": 0.6,
        "url": "http://www.ibm.com/support/docview.wss?uid=ibm10872060"
      },
      {
        "trust": 0.6,
        "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10872060"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/75338"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1280.2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.2671/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/158639/gentoo-linux-security-advisory-202007-53.html"
      },
      {
        "trust": 0.6,
        "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10882554"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/152154/gentoo-linux-security-advisory-201903-16.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1410.2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.5087"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1280/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.3795/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1410/"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6111"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6109"
      },
      {
        "trust": 0.2,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.2,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6110"
      },
      {
        "trust": 0.2,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/863.html"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=59473"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-21"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/openssh/1:6.6p1-2ubuntu2.12"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/openssh/1:7.2p2-4ubuntu2.7"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/openssh/1:7.7p1-4ubuntu0.2"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/usn/usn-3885-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/openssh/1:7.6p1-4ubuntu0.2"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-0739"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12437"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-6111"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-6109"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20684"
      },
      {
        "trust": 0.1,
        "url": "https://sintonen.fi/advisories/scp-name-validator.patch"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2000-0992"
      },
      {
        "trust": 0.1,
        "url": "https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/openssh"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-20685"
      },
      {
        "db": "BID",
        "id": "106531"
      },
      {
        "db": "PACKETSTORM",
        "id": "151577"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "158639"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-20685"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2018-20685"
      },
      {
        "db": "BID",
        "id": "106531"
      },
      {
        "db": "PACKETSTORM",
        "id": "151577"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "158639"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-20685"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-01-10T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-20685"
      },
      {
        "date": "2019-01-10T00:00:00",
        "db": "BID",
        "id": "106531"
      },
      {
        "date": "2019-02-07T19:22:22",
        "db": "PACKETSTORM",
        "id": "151577"
      },
      {
        "date": "2019-03-20T16:09:02",
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "date": "2020-07-29T00:06:47",
        "db": "PACKETSTORM",
        "id": "158639"
      },
      {
        "date": "2019-11-06T15:55:27",
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "date": "2019-01-16T15:04:39",
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "date": "2019-02-11T16:13:15",
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "date": "2019-01-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      },
      {
        "date": "2019-03-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      },
      {
        "date": "2019-01-10T21:29:00.377000",
        "db": "NVD",
        "id": "CVE-2018-20685"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-02-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-20685"
      },
      {
        "date": "2019-04-18T12:00:00",
        "db": "BID",
        "id": "106531"
      },
      {
        "date": "2022-12-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      },
      {
        "date": "2019-03-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      },
      {
        "date": "2025-12-17T22:15:55.163000",
        "db": "NVD",
        "id": "CVE-2018-20685"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "151577"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      }
    ],
    "trust": 0.8
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenSSH Access control vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-013957"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "access control error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-347"
      }
    ],
    "trust": 0.6
  }
}

VAR-201901-0012

Vulnerability from variot - Updated: 2025-12-19 19:55

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). OpenSSH Contains an input validation vulnerability.Information may be tampered with. OpenSSH is prone to an arbitrary file-overwrite vulnerability. Successful exploits may allow an attacker to overwrite arbitrary files in the context of the user running the affected application. OpenSSH 7.9 and prior versions are vulnerable. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201903-16

                                       https://security.gentoo.org/

Severity: Normal Title: OpenSSH: Multiple vulnerabilities Date: March 20, 2019 Bugs: #675520, #675522 ID: 201903-16

Synopsis

Multiple vulnerabilities have been found in OpenSSH, the worst of which could allow a remote attacker to gain unauthorized access.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 net-misc/openssh < 7.9_p1-r4 >= 7.9_p1-r4

Description

Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.

Workaround

There is no known workaround at this time.

Resolution

All OpenSSH users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.9_p1-r4"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/201903-16

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

===================================================================== Red Hat Security Advisory

Summary:

An update for openssh is now available for Red Hat Enterprise Linux 8.

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

Description:

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

The following packages have been upgraded to a later upstream version: openssh (8.0p1).

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Red Hat Enterprise Linux BaseOS (v. 8):

Source: openssh-8.0p1-3.el8.src.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce .

Description

Many scp clients fail to verify if the objects returned by the scp server match those it asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate flaw in the client allows the target directory attributes to be changed arbitrarily. Finally, two vulnerabilities in clients may allow server to spoof the client output.

Details

The discovered vulnerabilities, described in more detail below, enables the attack described here in brief.

The transfer of extra files is hidden by sending ANSI control sequences via stderr. For example:

user@local:~$ scp user@remote:readme.txt . readme.txt 100% 494 1.6KB/s 00:00 user@local:~$
Once the victim launches a new shell, the malicious commands in .bash_aliases get executed.

*) Man-in-the-Middle attack does require the victim to accept the wrong host fingerprint.

Vulnerabilities

The same vulnerability in WinSCP is known as CVE-2018-20684.

CWE-451: scp client spoofing via object name [CVE-2019-6109]

Due to missing character encoding in the progress display, the object name can be used to manipulate the client output, for example to employ ANSI codes to hide additional files being transferred.

Proof-of-Concept

Proof of concept malicious scp server will be released at a later date.

Vulnerable versions

The following software packages have some or all vulnerabilities:

                ver      #1  #2  #3  #4

OpenSSH scp <=7.9 x x x x PuTTY PSCP ? - - x x WinSCP scp mode <=5.13 - x - -

Tectia SSH scpg3 is not affected since it exclusively uses sftp protocol.

Mitigation

OpenSSH

1.1 Switch to sftp if possible

1.2 Alternatively apply the following patch to harden scp against most server-side manipulation attempts: https://sintonen.fi/advisories/scp-name-validator.patch

 NOTE: This patch may cause problems if the the remote and local shells don't
 agree on the way glob() pattern matching works. YMMV.

PuTTY

2.1 No fix is available yet

WinSCP

3.1. Upgrade to WinSCP 5.14 or later

Similar or prior work

https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access

Credits

The vulnerability was discovered by Harry Sintonen / F-Secure Corporation.

Timeline

. ========================================================================== Ubuntu Security Notice USN-3885-2 March 04, 2019

openssh vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 18.10
Ubuntu 18.04 LTS
Ubuntu 16.04 LTS
Ubuntu 14.04 LTS

Summary:

One of the fixes in USN-3885-1 was incomplete.

Software Description: - openssh: secure shell (SSH) for secure access to remote machines

Details:

USN-3885-1 fixed vulnerabilities in OpenSSH. It was discovered that the fix for CVE-2019-6111 turned out to be incomplete. This update fixes the problem.

Original advisory details:

Harry Sintonen discovered multiple issues in the OpenSSH scp utility.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10: openssh-client 1:7.7p1-4ubuntu0.3

Ubuntu 18.04 LTS: openssh-client 1:7.6p1-4ubuntu0.3

Ubuntu 16.04 LTS: openssh-client 1:7.2p2-4ubuntu2.8

Ubuntu 14.04 LTS: openssh-client 1:6.6p1-2ubuntu2.13

In general, a standard system update will make all the necessary changes. All the vulnerabilities are in found in the scp client implementing the SCP protocol. The check added in this version can lead to regression if the client and the server have differences in wildcard expansion rules. If the server is trusted for that purpose, the check can be disabled with a new -T option to the scp client.

For the stable distribution (stretch), these problems have been fixed in version 1:7.4p1-10+deb9u5.

For the detailed security status of openssh please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssh

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201901-0012",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "scalance x204rna eec",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.7"
      },
      {
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.2"
      },
      {
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.4"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.0"
      },
      {
        "model": "openssh",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "openbsd",
        "version": "7.9"
      },
      {
        "model": "mina sshd",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "2.2.0"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "freebsd",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "freebsd",
        "version": "12.0"
      },
      {
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "14.04"
      },
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.6"
      },
      {
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.1"
      },
      {
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "8.0"
      },
      {
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.4"
      },
      {
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.6"
      },
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.2"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.10"
      },
      {
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "winscp",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "winscp",
        "version": "5.1.3"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "16.04"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.2"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "scalance x204rna",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.7"
      },
      {
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "30"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.6"
      },
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.4"
      },
      {
        "model": "freebsd",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "freebsd",
        "version": "12.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "ubuntu",
        "scope": null,
        "trust": 0.8,
        "vendor": "canonical",
        "version": null
      },
      {
        "model": "gnu/linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "debian",
        "version": null
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "openbsd",
        "version": "7.9"
      },
      {
        "model": "winscp",
        "scope": null,
        "trust": 0.8,
        "vendor": "winscp",
        "version": null
      },
      {
        "model": "enterprise linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "red hat",
        "version": null
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.2"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.0"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.7.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.7"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.6.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.5"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.4"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.3"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.2"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.0.2"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.0.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "3.0"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "2.9.9"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "2.9"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "2.5.2"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "2.5.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "2.5"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "2.3"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "2.2"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "2.1.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "2.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "1.2.3"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "1.2.2"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.9"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.7"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.6"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.4"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.3"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.2"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.0"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.9"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.8"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.7"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.6"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.5"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.4"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.3"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.2"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "6.0"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "5.8"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "5.7"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "5.6"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "5.5"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "5.4"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "5.3"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "5.2"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "5.1"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "5.0"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.9"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.8"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.7"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.6"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.5"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.4"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "4.3.0"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "1.127"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "1.126"
      },
      {
        "model": "traffix sdc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "5.1"
      },
      {
        "model": "traffix sdc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "5.0"
      },
      {
        "model": "traffix sdc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.4"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106741"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6111"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:canonical:ubuntu_linux",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:debian:debian_linux",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:openbsd:openssh",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:winscp:winscp",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:redhat:enterprise_linux",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Ubuntu,Harry Sintonen,Gentoo",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2019-6111",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2019-6111",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.2,
            "id": "CVE-2019-6111",
            "impactScore": 3.6,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.9,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2019-6111",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2019-6111",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2019-6111",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2019-6111",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201901-767",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2019-6111",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6111"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6111"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6111"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). OpenSSH Contains an input validation vulnerability.Information may be tampered with. OpenSSH is prone to an arbitrary file-overwrite vulnerability. \nSuccessful exploits may allow an attacker to overwrite arbitrary files in the context of the user running the affected application. \nOpenSSH 7.9 and prior versions are vulnerable. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201903-16\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: OpenSSH: Multiple vulnerabilities\n     Date: March 20, 2019\n     Bugs: #675520, #675522\n       ID: 201903-16\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in OpenSSH, the worst of which\ncould allow a remote attacker to gain unauthorized access. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  net-misc/openssh           \u003c 7.9_p1-r4              \u003e= 7.9_p1-r4 \n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in OpenSSH. Please review\nthe CVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll OpenSSH users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=net-misc/openssh-7.9_p1-r4\"\n\nReferences\n==========\n\n[ 1 ] CVE-2018-20685\n      https://nvd.nist.gov/vuln/detail/CVE-2018-20685\n[ 2 ] CVE-2019-6109\n      https://nvd.nist.gov/vuln/detail/CVE-2019-6109\n[ 3 ] CVE-2019-6110\n      https://nvd.nist.gov/vuln/detail/CVE-2019-6110\n[ 4 ] CVE-2019-6111\n      https://nvd.nist.gov/vuln/detail/CVE-2019-6111\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201903-16\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2019 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Moderate: openssh security, bug fix, and enhancement update\nAdvisory ID:       RHSA-2019:3702-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2019:3702\nIssue date:        2019-11-05\nCVE Names:         CVE-2018-20685 CVE-2019-6109 CVE-2019-6111 \n=====================================================================\n\n1. Summary:\n\nAn update for openssh is now available for Red Hat Enterprise Linux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. Relevant releases/architectures:\n\nRed Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64\n\n3. Description:\n\nOpenSSH is an SSH protocol implementation supported by a number of Linux,\nUNIX, and similar operating systems. It includes the core files necessary\nfor both the OpenSSH client and server. \n\nThe following packages have been upgraded to a later upstream version:\nopenssh (8.0p1). \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 8.1 Release Notes linked from the References section. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, the OpenSSH server daemon (sshd) will be\nrestarted automatically. \n1686065 - SSH connections get closed when time-based rekeyring is used and ClientAliveMaxCount=0\n1691045 - Rebase OpenSSH to latest release (8.0p1?)\n1707485 - Use high-level API to do signatures\n1712436 - MD5 is used when writing password protected PEM\n1732424 - ssh-keygen -A fails in FIPS mode because of DSA key\n1732449 - rsa-sha2-*-cert-v01@openssh.com host key types are ignored in FIPS despite being in the policy\n\n6. Package List:\n\nRed Hat Enterprise Linux AppStream (v. 8):\n\naarch64:\nopenssh-askpass-8.0p1-3.el8.aarch64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debugsource-8.0p1-3.el8.aarch64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm\n\nppc64le:\nopenssh-askpass-8.0p1-3.el8.ppc64le.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debugsource-8.0p1-3.el8.ppc64le.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm\n\ns390x:\nopenssh-askpass-8.0p1-3.el8.s390x.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debugsource-8.0p1-3.el8.s390x.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.s390x.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm\n\nx86_64:\nopenssh-askpass-8.0p1-3.el8.x86_64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debugsource-8.0p1-3.el8.x86_64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm\n\nRed Hat Enterprise Linux BaseOS (v. 8):\n\nSource:\nopenssh-8.0p1-3.el8.src.rpm\n\naarch64:\nopenssh-8.0p1-3.el8.aarch64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-cavs-8.0p1-3.el8.aarch64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-clients-8.0p1-3.el8.aarch64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debugsource-8.0p1-3.el8.aarch64.rpm\nopenssh-keycat-8.0p1-3.el8.aarch64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-ldap-8.0p1-3.el8.aarch64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-server-8.0p1-3.el8.aarch64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.aarch64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm\n\nppc64le:\nopenssh-8.0p1-3.el8.ppc64le.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-cavs-8.0p1-3.el8.ppc64le.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-clients-8.0p1-3.el8.ppc64le.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debugsource-8.0p1-3.el8.ppc64le.rpm\nopenssh-keycat-8.0p1-3.el8.ppc64le.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-ldap-8.0p1-3.el8.ppc64le.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-server-8.0p1-3.el8.ppc64le.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.ppc64le.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm\n\ns390x:\nopenssh-8.0p1-3.el8.s390x.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-cavs-8.0p1-3.el8.s390x.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-clients-8.0p1-3.el8.s390x.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debugsource-8.0p1-3.el8.s390x.rpm\nopenssh-keycat-8.0p1-3.el8.s390x.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-ldap-8.0p1-3.el8.s390x.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-server-8.0p1-3.el8.s390x.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.s390x.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.s390x.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm\n\nx86_64:\nopenssh-8.0p1-3.el8.x86_64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-cavs-8.0p1-3.el8.x86_64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-clients-8.0p1-3.el8.x86_64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debugsource-8.0p1-3.el8.x86_64.rpm\nopenssh-keycat-8.0p1-3.el8.x86_64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-ldap-8.0p1-3.el8.x86_64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-server-8.0p1-3.el8.x86_64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.x86_64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-20685\nhttps://access.redhat.com/security/cve/CVE-2019-6109\nhttps://access.redhat.com/security/cve/CVE-2019-6111\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2019 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXcHzKNzjgjWX9erEAQiytQ/6Apphov2V0QmnXA+KO3ZZKBPXtgKv8Sv1\ndPtXhTC+Keq4yX9/bXlIuyk6BUsMeaiIMlL5bSSKtq2I7rVxwubTcPX4rD+pQvx8\nArNJgn7U2/3xqwc0R8dNXx6o8vB1M6jXDtu8fKJOxW48evDJf6gE4gX2KUM9yxR2\nMhCoHVkLp9a5f0T11yFPI11H0P8gXXQgboAkdt82Ui35T4tD8RndVyPCsllN2c/X\nQCCbvZ9e8OLJJoxsOryLcw8tpQHXK2AJMXWv0Us99kQtbaBULWWahhrg/tftLxtT\npILFBaB/RsmGg1O6OkxJ2CuKl6ATC2Wlj/Z7uYPrS7MQDn+fXkH2gfcjb4Z4rqIL\nIyKbUpsyFEAaV5rJUeRaS7dGfuQldQbS96P8lUpCcOXPbYD8FgTrW2q3NjOKgYMU\n+gh2xPwmlRm+iYfmedPoR2+bTWNYv8JS+Cp/fZF4IFx2EJPQcxKLYshNKgcfkNkR\nrIZ4brUI79p84H01TcTh4mFAbR63Y+c36UAI3/fM/W/RkZn/PdoJtpfwg/tjOYZH\nrt9kL7SfAEhjHNtBuJGNol6e124srS6300hnfFovAr6llDOcYlrh3ZgVZjVrn6E8\nTZhyZ84TGMOqykfH7B9XkJH82X+x3rd2m0ovCPq+Ly62BasdXVd0C2snzbx8OAM8\nI+am8dhVlyM=\n=iPw4\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. \n\n\nDescription\n-----------\n\nMany scp clients fail to verify if the objects returned by the scp server match those\nit asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate\nflaw in the client allows the target directory attributes to be changed arbitrarily. \nFinally, two vulnerabilities in clients may allow server to spoof the client output. \n\n\nDetails\n-------\n\nThe discovered vulnerabilities, described in more detail below, enables the attack\ndescribed here in brief. \n\n1. The transfer of extra files is hidden by sending ANSI control sequences\n    via stderr. For example:\n\n    user@local:~$ scp user@remote:readme.txt . \n    readme.txt                                         100%  494     1.6KB/s   00:00\n    user@local:~$\n\n2. Once the victim launches a new shell, the malicious commands in .bash_aliases get\n    executed. \n\n\n*) Man-in-the-Middle attack does require the victim to accept the wrong host\n    fingerprint. \n\n\nVulnerabilities\n---------------\n\n1. \n\n\n2. \n\nThe same vulnerability in WinSCP is known as CVE-2018-20684. \n\n\n3. CWE-451: scp client spoofing via object name [CVE-2019-6109]\n\nDue to missing character encoding in the progress display, the object name can be used\nto manipulate the client output, for example to employ ANSI codes to hide additional\nfiles being transferred. \n\n\n4. \n\n\nProof-of-Concept\n----------------\n\nProof of concept malicious scp server will be released at a later date. \n\n\nVulnerable versions\n-------------------\n\nThe following software packages have some or all vulnerabilities:\n\n                    ver      #1  #2  #3  #4\nOpenSSH scp        \u003c=7.9    x   x   x   x\nPuTTY PSCP         ?        -   -   x   x\nWinSCP scp mode    \u003c=5.13   -   x   -   -\n\nTectia SSH scpg3 is not affected since it exclusively uses sftp protocol. \n\n\nMitigation\n----------\n\n1. OpenSSH\n\n1.1 Switch to sftp if possible\n\n1.2 Alternatively apply the following patch to harden scp against most server-side\n     manipulation attempts: https://sintonen.fi/advisories/scp-name-validator.patch\n\n     NOTE: This patch may cause problems if the the remote and local shells don\u0027t\n     agree on the way glob() pattern matching works. YMMV. \n\n2. PuTTY\n\n2.1 No fix is available yet\n\n3. WinSCP\n\n3.1. Upgrade to WinSCP 5.14 or later\n\n\n\nSimilar or prior work\n---------------------\n\n1. https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access\n\n\nCredits\n-------\n\nThe vulnerability was discovered by Harry Sintonen / F-Secure Corporation. \n\n\nTimeline\n--------\n\n2018.08.08  initial discovery of vulnerabilities #1 and #2\n2018.08.09  reported vulnerabilities #1 and #2 to OpenSSH\n2018.08.10  OpenSSH acknowledged the vulnerabilities\n2018.08.14  discovered \u0026 reported vulnerability #3 to OpenSSH\n2018.08.15  discovered \u0026 reported vulnerability #4 to OpenSSH\n2018.08.30  reported PSCP vulnerabilities (#3 and #4) to PuTTY developers\n2018.08.31  reported WinSCP vulnerability (#2) to WinSCP developers\n2018.09.04  WinSCP developers reported the vulnerability #2 fixed\n2018.11.12  requested a status update from OpenSSH\n2018.11.16  OpenSSH fixed vulnerability #1\n2019.01.07  requested a status update from OpenSSH\n2019.01.08  requested CVE assignments from MITRE\n2019.01.10  received CVE assignments from MITRE\n2019.01.11  public disclosure of the advisory\n2019.01.14  added a warning about the potential issues caused by the patch\n\n\n. ==========================================================================\nUbuntu Security Notice USN-3885-2\nMarch 04, 2019\n\nopenssh vulnerability\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 18.10\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n- Ubuntu 14.04 LTS\n\nSummary:\n\nOne of the fixes in USN-3885-1 was incomplete. \n\nSoftware Description:\n- openssh: secure shell (SSH) for secure access to remote machines\n\nDetails:\n\nUSN-3885-1 fixed vulnerabilities in OpenSSH. It was discovered that the fix\nfor CVE-2019-6111 turned out to be incomplete. This update fixes the\nproblem. \n\nOriginal advisory details:\n\n Harry Sintonen discovered multiple issues in the OpenSSH scp utility. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 18.10:\n  openssh-client                  1:7.7p1-4ubuntu0.3\n\nUbuntu 18.04 LTS:\n  openssh-client                  1:7.6p1-4ubuntu0.3\n\nUbuntu 16.04 LTS:\n  openssh-client                  1:7.2p2-4ubuntu2.8\n\nUbuntu 14.04 LTS:\n  openssh-client                  1:6.6p1-2ubuntu2.13\n\nIn general, a standard system update will make all the necessary changes. All the vulnerabilities\nare in found in the scp client implementing the SCP protocol. \n    The check added in this version can lead to regression if the client and\n    the server have differences in wildcard expansion rules. If the server is\n    trusted for that purpose, the check can be disabled with a new -T option to\n    the scp client. \n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1:7.4p1-10+deb9u5. \n\nFor the detailed security status of openssh please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/openssh\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAlxe0w0ACgkQ3rYcyPpX\nRFs85AgA0GrSHO4Qf5FVsE3oXa+nMkZ4U6pbOA9dHotX54DEyNuIJrOsOv01cFxQ\nt2Z6uDkZptmHZT4uSWg2xIgMvpkGo9906ziZfHc0LTuHl8j++7cCDIDGZBm/iZaX\nueQfl85gHDpte41JvUtpSBAwk1Bic7ltLUPDIGEiq6nQboxHIzsU7ULVb1l0wNxF\nsEFDPWGBS01HTa+QWgQaG/wbEhMRDcVz1Ck7dqpT2soQRohDWxU01j14q1EKe9O9\nGHiWECvFSHBkkI/v8lNfSWnOWYa/+Aknri0CpjPc/bqh2Yx9rgp/Q5+FJ/FxJjmC\nbHFd+tbxB1LxEO96zKguYpPIzw7Kcw==\n=5Fd8\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6111"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      },
      {
        "db": "BID",
        "id": "106741"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-6111"
      },
      {
        "db": "PACKETSTORM",
        "id": "151948"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151954"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      }
    ],
    "trust": 2.52
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=46193",
        "trust": 0.2,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6111"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-6111",
        "trust": 3.4
      },
      {
        "db": "BID",
        "id": "106741",
        "trust": 2.0
      },
      {
        "db": "EXPLOIT-DB",
        "id": "46193",
        "trust": 1.7
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2022/08/02/1",
        "trust": 1.7
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2019/04/18/1",
        "trust": 1.7
      },
      {
        "db": "SIEMENS",
        "id": "SSA-412672",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "152154",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "151954",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.1255",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1280.2",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1411.2",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1280",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1411.3",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0410.3",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1411",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0605",
        "trust": 0.6
      },
      {
        "db": "EXPLOIT-DB",
        "id": "46516",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-767",
        "trust": 0.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-349-21",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-6111",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "151948",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "155158",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "151175",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "151601",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6111"
      },
      {
        "db": "BID",
        "id": "106741"
      },
      {
        "db": "PACKETSTORM",
        "id": "151948"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151954"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6111"
      }
    ]
  },
  "id": "VAR-201901-0012",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.64041158
  },
  "last_update_date": "2025-12-19T19:55:49.662000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "[SECURITY] [DLA 1728-1] openssh security update",
        "trust": 0.8,
        "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html"
      },
      {
        "title": "DSA-4387",
        "trust": 0.8,
        "url": "https://www.debian.org/security/2019/dsa-4387"
      },
      {
        "title": "CVS log for src/usr.bin/ssh/scp.c",
        "trust": 0.8,
        "url": "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c"
      },
      {
        "title": "Bug 1677794",
        "trust": 0.8,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677794"
      },
      {
        "title": "USN-3885-1",
        "trust": 0.8,
        "url": "https://usn.ubuntu.com/3885-1/"
      },
      {
        "title": "USN-3885-2",
        "trust": 0.8,
        "url": "https://usn.ubuntu.com/3885-2/"
      },
      {
        "title": "Recent Version History",
        "trust": 0.8,
        "url": "https://winscp.net/eng/docs/history"
      },
      {
        "title": "OpenSSH Security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=88866"
      },
      {
        "title": "The Register",
        "trust": 0.2,
        "url": "https://www.theregister.co.uk/2019/01/15/scp_vulnerability/"
      },
      {
        "title": "Red Hat: Moderate: openssh security, bug fix, and enhancement update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20193702 - Security Advisory"
      },
      {
        "title": "Ubuntu Security Notice: openssh vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3885-2"
      },
      {
        "title": "Ubuntu Security Notice: openssh vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3885-1"
      },
      {
        "title": "Debian CVElist Bug Report Logs: openssh-client: scp can send arbitrary control characters / escape sequences to the terminal (CVE-2019-6109)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=dffe92fd93b8f745f5f15bc2f29dc935"
      },
      {
        "title": "Debian CVElist Bug Report Logs: CVE-2019-6111 not fixed, file transfer of unwanted files by malicious SSH server still possible",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=74b791ca4fdf54c27d2b50ef6845ef8e"
      },
      {
        "title": "Debian CVElist Bug Report Logs: netkit-rsh: CVE-2019-7282 CVE-2019-7283",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=a043554ad34dcb6b0dc285dc8ea3ce0d"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2019-6111"
      },
      {
        "title": "Debian CVElist Bug Report Logs: openssh: CVE-2018-20685: scp.c in the scp client allows remote SSH servers to bypass intended access restrictions",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=8394bb17731a99ef76b185cbc70acfa3"
      },
      {
        "title": "Arch Linux Advisories: [ASA-201904-11] openssh: multiple issues",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201904-11"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2019-1313",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2019-1313"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2019-1216",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2019-1216"
      },
      {
        "title": "IBM: IBM Security Bulletin: Vulnerabilities in OpenSSH affect AIX (CVE-2018-20685 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111) Security Bulletin",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=50a54c2fb43b489f64442dcf4f25bc3b"
      },
      {
        "title": "IBM: Security Bulletin: Multiple vulnerabilities affect IBM Cloud Object Storage Systems (February 2020v1)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=979e60202a29c3c55731e37f8ddc5a3b"
      },
      {
        "title": "IBM: IBM Security Bulletin: Vyatta 5600 vRouter Software Patches \u2013 Releases 1801-w and 1801-y",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=bf3f2299a8658b7cd3984c40e7060666"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=ec6577109e640dac19a6ddb978afe82d"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Live-Hack-CVE/CVE-2019-6111 "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/AntonVanAssche/CSV-NPE2223 "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/TommasoBilotta/public "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/h4xrOx/Direct-Admin-Vulnerability-Disclosure "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/numaan911098/leadgenapp-bug-report "
      },
      {
        "title": "DC-4-Vulnhub-Walkthrough",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/DC-4-Vulnhub-Walkthrough "
      },
      {
        "title": "nmap",
        "trust": 0.1,
        "url": "https://github.com/devairdarolt/nmap "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Iknowmyname/Nmap-Scans-M2 "
      },
      {
        "title": "cveScannerV2",
        "trust": 0.1,
        "url": "https://github.com/retr0-13/cveScannerV2 "
      },
      {
        "title": "TrivyWeb",
        "trust": 0.1,
        "url": "https://github.com/KorayAgaya/TrivyWeb "
      },
      {
        "title": "iot-cves",
        "trust": 0.1,
        "url": "https://github.com/InesMartins31/iot-cves "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/scmanjarrez/testrepository "
      },
      {
        "title": "github_aquasecurity_trivy",
        "trust": 0.1,
        "url": "https://github.com/back8/github_aquasecurity_trivy "
      },
      {
        "title": "Funbox2-rookie",
        "trust": 0.1,
        "url": "https://github.com/vaishali1998/Funbox2-rookie "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/simiyo/trivy "
      },
      {
        "title": "security",
        "trust": 0.1,
        "url": "https://github.com/umahari/security "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Mohzeela/external-secret "
      },
      {
        "title": "Vulnerability-Scanner-for-Containers",
        "trust": 0.1,
        "url": "https://github.com/t31m0/Vulnerability-Scanner-for-Containers "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/aquasecurity/trivy "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/knqyf263/trivy "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/siddharthraopotukuchi/trivy "
      },
      {
        "title": "Basic-Pentesting-2-Vulnhub-Walkthrough",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/Basic-Pentesting-2-Vulnhub-Walkthrough "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/bioly230/THM_Skynet "
      },
      {
        "title": "Basic-Pentesting-2",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/Basic-Pentesting-2 "
      },
      {
        "title": "PoC",
        "trust": 0.1,
        "url": "https://github.com/Jonathan-Elias/PoC "
      },
      {
        "title": "PoC-in-GitHub",
        "trust": 0.1,
        "url": "https://github.com/developer3000S/PoC-in-GitHub "
      },
      {
        "title": "CVE-POC",
        "trust": 0.1,
        "url": "https://github.com/0xT11/CVE-POC "
      },
      {
        "title": "PoC-in-GitHub",
        "trust": 0.1,
        "url": "https://github.com/hectorgie/PoC-in-GitHub "
      },
      {
        "title": "PoC-in-GitHub",
        "trust": 0.1,
        "url": "https://github.com/nomi-sec/PoC-in-GitHub "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6111"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-20",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6111"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.9,
        "url": "http://www.securityfocus.com/bid/106741"
      },
      {
        "trust": 2.5,
        "url": "https://access.redhat.com/errata/rhsa-2019:3702"
      },
      {
        "trust": 2.3,
        "url": "https://www.debian.org/security/2019/dsa-4387"
      },
      {
        "trust": 2.1,
        "url": "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt"
      },
      {
        "trust": 2.0,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6111"
      },
      {
        "trust": 1.8,
        "url": "https://usn.ubuntu.com/3885-2/"
      },
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/201903-16"
      },
      {
        "trust": 1.7,
        "url": "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c"
      },
      {
        "trust": 1.7,
        "url": "https://www.exploit-db.com/exploits/46193/"
      },
      {
        "trust": 1.7,
        "url": "https://usn.ubuntu.com/3885-1/"
      },
      {
        "trust": 1.7,
        "url": "https://security.netapp.com/advisory/ntap-20190213-0001/"
      },
      {
        "trust": 1.7,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677794"
      },
      {
        "trust": 1.7,
        "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.openwall.com/lists/oss-security/2019/04/18/1"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.freebsd.org/security/advisories/freebsd-en-19:10.scp.asc"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.openwall.com/lists/oss-security/2022/08/02/1"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
      },
      {
        "trust": 1.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/w3yvq2bptovdcfdvnc2ggf5p5isfg37g/"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6111"
      },
      {
        "trust": 0.6,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/w3yvq2bptovdcfdvnc2ggf5p5isfg37g/"
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a@%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b@%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f@%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23@%3cdev.mina.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190496-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914016-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1411/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/75338"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1280.2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.exploit-db.com/exploits/46516"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/76170"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/152154/gentoo-linux-security-advisory-201903-16.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/151954/ubuntu-security-notice-usn-3885-2.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1411.2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1280/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1411.3"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/78934"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-6111"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6109"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20685"
      },
      {
        "trust": 0.3,
        "url": "http://www.openssh.org/"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666127"
      },
      {
        "trust": 0.3,
        "url": "https://support.f5.com/csp/article/k21350967"
      },
      {
        "trust": 0.2,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.2,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.2,
        "url": "https://security-tracker.debian.org/tracker/openssh"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6110"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/22.html"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=59544"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/46193"
      },
      {
        "trust": 0.1,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-21"
      },
      {
        "trust": 0.1,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-6109"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-20685"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20684"
      },
      {
        "trust": 0.1,
        "url": "https://sintonen.fi/advisories/scp-name-validator.patch"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2000-0992"
      },
      {
        "trust": 0.1,
        "url": "https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/openssh/1:6.6p1-2ubuntu2.13"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/openssh/1:7.7p1-4ubuntu0.3"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/openssh/1:7.2p2-4ubuntu2.8"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/usn/usn-3885-1"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/usn/usn-3885-2"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/openssh/1:7.6p1-4ubuntu0.3"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6111"
      },
      {
        "db": "BID",
        "id": "106741"
      },
      {
        "db": "PACKETSTORM",
        "id": "151948"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151954"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6111"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6111"
      },
      {
        "db": "BID",
        "id": "106741"
      },
      {
        "db": "PACKETSTORM",
        "id": "151948"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151954"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6111"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-01-31T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-6111"
      },
      {
        "date": "2019-01-18T00:00:00",
        "db": "BID",
        "id": "106741"
      },
      {
        "date": "2019-03-04T21:54:21",
        "db": "PACKETSTORM",
        "id": "151948"
      },
      {
        "date": "2019-03-20T16:09:02",
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "date": "2019-11-06T15:55:27",
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "date": "2019-01-16T15:04:39",
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "date": "2019-03-04T21:58:39",
        "db": "PACKETSTORM",
        "id": "151954"
      },
      {
        "date": "2019-02-11T16:13:15",
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "date": "2019-01-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      },
      {
        "date": "2019-03-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      },
      {
        "date": "2019-01-31T18:29:00.867000",
        "db": "NVD",
        "id": "CVE-2019-6111"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-6111"
      },
      {
        "date": "2019-01-18T00:00:00",
        "db": "BID",
        "id": "106741"
      },
      {
        "date": "2022-12-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      },
      {
        "date": "2019-03-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      },
      {
        "date": "2025-12-18T15:15:48.147000",
        "db": "NVD",
        "id": "CVE-2019-6111"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "151954"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      }
    ],
    "trust": 0.8
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenSSH Input validation vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001830"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "path traversal",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-767"
      }
    ],
    "trust": 0.6
  }
}

VAR-201901-0010

Vulnerability from variot - Updated: 2024-11-23 20:22

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. OpenSSH Contains an access control vulnerability.Information may be obtained and information may be altered. OpenSSH is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks. OpenSSH 7.9 version is vulnerable; other versions may also be affected. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201903-16

                                       https://security.gentoo.org/

Severity: Normal Title: OpenSSH: Multiple vulnerabilities Date: March 20, 2019 Bugs: #675520, #675522 ID: 201903-16

Synopsis

Multiple vulnerabilities have been found in OpenSSH, the worst of which could allow a remote attacker to gain unauthorized access. Please review the CVE identifiers referenced below for details.

Workaround

There is no known workaround at this time.

Resolution

All OpenSSH users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.9_p1-r4"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/201903-16

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

===================================================================== Red Hat Security Advisory

Summary:

An update for openssh is now available for Red Hat Enterprise Linux 8.

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

Description:

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

The following packages have been upgraded to a later upstream version: openssh (8.0p1).

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Red Hat Enterprise Linux BaseOS (v. 8):

Source: openssh-8.0p1-3.el8.src.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

Overview

SCP clients from multiple vendors are susceptible to a malicious scp server performing unauthorized changes to target directory and/or client output manipulation.

Description

Impact

Malicious scp server can write arbitrary files to scp target directory, change the target directory permissions and to spoof the client output.

Details

The discovered vulnerabilities, described in more detail below, enables the attack described here in brief.

The attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases file to victim's home directory when the victim performs scp operation from the server. The transfer of extra files is hidden by sending ANSI control sequences via stderr. For example:

user@local:~$ scp user@remote:readme.txt . readme.txt 100% 494 1.6KB/s 00:00 user@local:~$
Once the victim launches a new shell, the malicious commands in .bash_aliases get executed.

*) Man-in-the-Middle attack does require the victim to accept the wrong host fingerprint.

Vulnerabilities

CWE-20: scp client improper directory name validation [CVE-2018-20685]

The scp client allows server to modify permissions of the target directory by using empty ("D0777 0 \n") or dot ("D0777 0 .\n") directory name.

CWE-20: scp client missing received object name validation [CVE-2019-6111]

The same vulnerability in WinSCP is known as CVE-2018-20684.

Proof-of-Concept

Proof of concept malicious scp server will be released at a later date.

Vulnerable versions

The following software packages have some or all vulnerabilities:

                ver      #1  #2  #3  #4

OpenSSH scp <=7.9 x x x x PuTTY PSCP ? - - x x WinSCP scp mode <=5.13 - x - -

Tectia SSH scpg3 is not affected since it exclusively uses sftp protocol.

Mitigation

OpenSSH

1.1 Switch to sftp if possible

1.2 Alternatively apply the following patch to harden scp against most server-side manipulation attempts: https://sintonen.fi/advisories/scp-name-validator.patch

 NOTE: This patch may cause problems if the the remote and local shells don't
 agree on the way glob() pattern matching works. YMMV.

PuTTY

2.1 No fix is available yet

WinSCP

3.1. Upgrade to WinSCP 5.14 or later

Similar or prior work

CVE-2000-0992 - scp overwrites arbitrary files

References

https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access

Credits

The vulnerability was discovered by Harry Sintonen / F-Secure Corporation.

Timeline

For the stable distribution (stretch), these problems have been fixed in version 1:7.4p1-10+deb9u5.

For the detailed security status of openssh please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssh

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201901-0010",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.4"
      },
      {
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "30"
      },
      {
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "storage automation store",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.6"
      },
      {
        "model": "openssh",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "openbsd",
        "version": "7.9"
      },
      {
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.1"
      },
      {
        "model": "m10-4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "scalance x204rna",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.7"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.4"
      },
      {
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "m10-4s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "m10-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "m12-2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "16.04"
      },
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.2"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.2"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "14.04"
      },
      {
        "model": "element software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "m12-1",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp3070"
      },
      {
        "model": "ontap select deploy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.0"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.6"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.10"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "8.0"
      },
      {
        "model": "winscp",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "winscp",
        "version": "5.13"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.2"
      },
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.6"
      },
      {
        "model": "m12-2s",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "fujitsu",
        "version": "xcp2361"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.4"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "scalance x204rna eec",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.7"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "openbsd",
        "version": "7.9"
      },
      {
        "model": "winscp",
        "scope": null,
        "trust": 0.8,
        "vendor": "winscp",
        "version": null
      },
      {
        "model": "linux enterprise server 12-sp2",
        "scope": null,
        "trust": 0.3,
        "vendor": "suse",
        "version": null
      },
      {
        "model": "linux enterprise server 12-sp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "suse",
        "version": null
      },
      {
        "model": "linux enterprise server sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "12"
      },
      {
        "model": "linux enterprise server ga",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "12"
      },
      {
        "model": "linux enterprise server sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "11"
      },
      {
        "model": "linux enterprise server sp3 ltss",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "11"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "5"
      },
      {
        "model": "openssh",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssh",
        "version": "7.9"
      },
      {
        "model": "traffix sdc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "5.1"
      },
      {
        "model": "traffix sdc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "5.0"
      },
      {
        "model": "traffix sdc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f5",
        "version": "4.4"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106843"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6109"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:openbsd:openssh",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:winscp:winscp",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Gentoo",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2019-6109",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "id": "CVE-2019-6109",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.6,
            "id": "CVE-2019-6109",
            "impactScore": 5.2,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.8,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2019-6109",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2019-6109",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2019-6109",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201901-467",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2019-6109",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6109"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6109"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. OpenSSH Contains an access control vulnerability.Information may be obtained and information may be altered. OpenSSH is prone to a security-bypass vulnerability. \nSuccessfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks. \nOpenSSH 7.9 version is  vulnerable; other versions may also be affected. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201903-16\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: OpenSSH: Multiple vulnerabilities\n     Date: March 20, 2019\n     Bugs: #675520, #675522\n       ID: 201903-16\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in OpenSSH, the worst of which\ncould allow a remote attacker to gain unauthorized access. Please review\nthe CVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll OpenSSH users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=net-misc/openssh-7.9_p1-r4\"\n\nReferences\n==========\n\n[ 1 ] CVE-2018-20685\n      https://nvd.nist.gov/vuln/detail/CVE-2018-20685\n[ 2 ] CVE-2019-6109\n      https://nvd.nist.gov/vuln/detail/CVE-2019-6109\n[ 3 ] CVE-2019-6110\n      https://nvd.nist.gov/vuln/detail/CVE-2019-6110\n[ 4 ] CVE-2019-6111\n      https://nvd.nist.gov/vuln/detail/CVE-2019-6111\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201903-16\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2019 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Moderate: openssh security, bug fix, and enhancement update\nAdvisory ID:       RHSA-2019:3702-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2019:3702\nIssue date:        2019-11-05\nCVE Names:         CVE-2018-20685 CVE-2019-6109 CVE-2019-6111 \n=====================================================================\n\n1. Summary:\n\nAn update for openssh is now available for Red Hat Enterprise Linux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. Relevant releases/architectures:\n\nRed Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64\n\n3. Description:\n\nOpenSSH is an SSH protocol implementation supported by a number of Linux,\nUNIX, and similar operating systems. It includes the core files necessary\nfor both the OpenSSH client and server. \n\nThe following packages have been upgraded to a later upstream version:\nopenssh (8.0p1). \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 8.1 Release Notes linked from the References section. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, the OpenSSH server daemon (sshd) will be\nrestarted automatically. \n1686065 - SSH connections get closed when time-based rekeyring is used and ClientAliveMaxCount=0\n1691045 - Rebase OpenSSH to latest release (8.0p1?)\n1707485 - Use high-level API to do signatures\n1712436 - MD5 is used when writing password protected PEM\n1732424 - ssh-keygen -A fails in FIPS mode because of DSA key\n1732449 - rsa-sha2-*-cert-v01@openssh.com host key types are ignored in FIPS despite being in the policy\n\n6. Package List:\n\nRed Hat Enterprise Linux AppStream (v. 8):\n\naarch64:\nopenssh-askpass-8.0p1-3.el8.aarch64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debugsource-8.0p1-3.el8.aarch64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm\n\nppc64le:\nopenssh-askpass-8.0p1-3.el8.ppc64le.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debugsource-8.0p1-3.el8.ppc64le.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm\n\ns390x:\nopenssh-askpass-8.0p1-3.el8.s390x.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debugsource-8.0p1-3.el8.s390x.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.s390x.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm\n\nx86_64:\nopenssh-askpass-8.0p1-3.el8.x86_64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debugsource-8.0p1-3.el8.x86_64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm\n\nRed Hat Enterprise Linux BaseOS (v. 8):\n\nSource:\nopenssh-8.0p1-3.el8.src.rpm\n\naarch64:\nopenssh-8.0p1-3.el8.aarch64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-cavs-8.0p1-3.el8.aarch64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-clients-8.0p1-3.el8.aarch64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-debugsource-8.0p1-3.el8.aarch64.rpm\nopenssh-keycat-8.0p1-3.el8.aarch64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-ldap-8.0p1-3.el8.aarch64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm\nopenssh-server-8.0p1-3.el8.aarch64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.aarch64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm\n\nppc64le:\nopenssh-8.0p1-3.el8.ppc64le.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-cavs-8.0p1-3.el8.ppc64le.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-clients-8.0p1-3.el8.ppc64le.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-debugsource-8.0p1-3.el8.ppc64le.rpm\nopenssh-keycat-8.0p1-3.el8.ppc64le.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-ldap-8.0p1-3.el8.ppc64le.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm\nopenssh-server-8.0p1-3.el8.ppc64le.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.ppc64le.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm\n\ns390x:\nopenssh-8.0p1-3.el8.s390x.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-cavs-8.0p1-3.el8.s390x.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-clients-8.0p1-3.el8.s390x.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-debugsource-8.0p1-3.el8.s390x.rpm\nopenssh-keycat-8.0p1-3.el8.s390x.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-ldap-8.0p1-3.el8.s390x.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm\nopenssh-server-8.0p1-3.el8.s390x.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.s390x.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.s390x.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm\n\nx86_64:\nopenssh-8.0p1-3.el8.x86_64.rpm\nopenssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-cavs-8.0p1-3.el8.x86_64.rpm\nopenssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-clients-8.0p1-3.el8.x86_64.rpm\nopenssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-debugsource-8.0p1-3.el8.x86_64.rpm\nopenssh-keycat-8.0p1-3.el8.x86_64.rpm\nopenssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-ldap-8.0p1-3.el8.x86_64.rpm\nopenssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm\nopenssh-server-8.0p1-3.el8.x86_64.rpm\nopenssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm\npam_ssh_agent_auth-0.10.3-7.3.el8.x86_64.rpm\npam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-20685\nhttps://access.redhat.com/security/cve/CVE-2019-6109\nhttps://access.redhat.com/security/cve/CVE-2019-6111\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2019 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXcHzKNzjgjWX9erEAQiytQ/6Apphov2V0QmnXA+KO3ZZKBPXtgKv8Sv1\ndPtXhTC+Keq4yX9/bXlIuyk6BUsMeaiIMlL5bSSKtq2I7rVxwubTcPX4rD+pQvx8\nArNJgn7U2/3xqwc0R8dNXx6o8vB1M6jXDtu8fKJOxW48evDJf6gE4gX2KUM9yxR2\nMhCoHVkLp9a5f0T11yFPI11H0P8gXXQgboAkdt82Ui35T4tD8RndVyPCsllN2c/X\nQCCbvZ9e8OLJJoxsOryLcw8tpQHXK2AJMXWv0Us99kQtbaBULWWahhrg/tftLxtT\npILFBaB/RsmGg1O6OkxJ2CuKl6ATC2Wlj/Z7uYPrS7MQDn+fXkH2gfcjb4Z4rqIL\nIyKbUpsyFEAaV5rJUeRaS7dGfuQldQbS96P8lUpCcOXPbYD8FgTrW2q3NjOKgYMU\n+gh2xPwmlRm+iYfmedPoR2+bTWNYv8JS+Cp/fZF4IFx2EJPQcxKLYshNKgcfkNkR\nrIZ4brUI79p84H01TcTh4mFAbR63Y+c36UAI3/fM/W/RkZn/PdoJtpfwg/tjOYZH\nrt9kL7SfAEhjHNtBuJGNol6e124srS6300hnfFovAr6llDOcYlrh3ZgVZjVrn6E8\nTZhyZ84TGMOqykfH7B9XkJH82X+x3rd2m0ovCPq+Ly62BasdXVd0C2snzbx8OAM8\nI+am8dhVlyM=\n=iPw4\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. scp client multiple vulnerabilities\n===================================\nThe latest version of this advisory is available at:\nhttps://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt\n\n\nOverview\n--------\n\nSCP clients from multiple vendors are susceptible to a malicious scp server performing\nunauthorized changes to target directory and/or client output manipulation. \n\n\nDescription\n-----------\n\nMany scp clients fail to verify if the objects returned by the scp server match those\nit asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate\nflaw in the client allows the target directory attributes to be changed arbitrarily. \nFinally, two vulnerabilities in clients may allow server to spoof the client output. \n\n\nImpact\n------\n\nMalicious scp server can write arbitrary files to scp target directory, change the\ntarget directory permissions and to spoof the client output. \n\n\nDetails\n-------\n\nThe discovered vulnerabilities, described in more detail below, enables the attack\ndescribed here in brief. \n\n1. The attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases\n    file to victim\u0027s home directory when the victim performs scp operation from the\n    server. The transfer of extra files is hidden by sending ANSI control sequences\n    via stderr. For example:\n\n    user@local:~$ scp user@remote:readme.txt . \n    readme.txt                                         100%  494     1.6KB/s   00:00\n    user@local:~$\n\n2. Once the victim launches a new shell, the malicious commands in .bash_aliases get\n    executed. \n\n\n*) Man-in-the-Middle attack does require the victim to accept the wrong host\n    fingerprint. \n\n\nVulnerabilities\n---------------\n\n1. CWE-20: scp client improper directory name validation [CVE-2018-20685]\n\nThe scp client allows server to modify permissions of the target directory by using empty\n(\"D0777 0 \\n\") or dot (\"D0777 0 .\\n\") directory name. \n\n\n2. CWE-20: scp client missing received object name validation [CVE-2019-6111]\n\nDue to the scp implementation being derived from 1983 rcp [1], the server chooses which\nfiles/directories are sent to the client. However, scp client only perform cursory\nvalidation of the object name returned (only directory traversal attacks are prevented). \nA malicious scp server can overwrite arbitrary files in the scp client target directory. \nIf recursive operation (-r) is performed, the server can manipulate subdirectories\nas well (for example overwrite .ssh/authorized_keys). \n\nThe same vulnerability in WinSCP is known as CVE-2018-20684. \n\n\n3. \n\n\n4. \n\n\nProof-of-Concept\n----------------\n\nProof of concept malicious scp server will be released at a later date. \n\n\nVulnerable versions\n-------------------\n\nThe following software packages have some or all vulnerabilities:\n\n                    ver      #1  #2  #3  #4\nOpenSSH scp        \u003c=7.9    x   x   x   x\nPuTTY PSCP         ?        -   -   x   x\nWinSCP scp mode    \u003c=5.13   -   x   -   -\n\nTectia SSH scpg3 is not affected since it exclusively uses sftp protocol. \n\n\nMitigation\n----------\n\n1. OpenSSH\n\n1.1 Switch to sftp if possible\n\n1.2 Alternatively apply the following patch to harden scp against most server-side\n     manipulation attempts: https://sintonen.fi/advisories/scp-name-validator.patch\n\n     NOTE: This patch may cause problems if the the remote and local shells don\u0027t\n     agree on the way glob() pattern matching works. YMMV. \n\n2. PuTTY\n\n2.1 No fix is available yet\n\n3. WinSCP\n\n3.1. Upgrade to WinSCP 5.14 or later\n\n\n\nSimilar or prior work\n---------------------\n\n1. CVE-2000-0992 - scp overwrites arbitrary files\n\n\nReferences\n----------\n\n1. https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access\n\n\nCredits\n-------\n\nThe vulnerability was discovered by Harry Sintonen / F-Secure Corporation. \n\n\nTimeline\n--------\n\n2018.08.08  initial discovery of vulnerabilities #1 and #2\n2018.08.09  reported vulnerabilities #1 and #2 to OpenSSH\n2018.08.10  OpenSSH acknowledged the vulnerabilities\n2018.08.14  discovered \u0026 reported vulnerability #3 to OpenSSH\n2018.08.15  discovered \u0026 reported vulnerability #4 to OpenSSH\n2018.08.30  reported PSCP vulnerabilities (#3 and #4) to PuTTY developers\n2018.08.31  reported WinSCP vulnerability (#2) to WinSCP developers\n2018.09.04  WinSCP developers reported the vulnerability #2 fixed\n2018.11.12  requested a status update from OpenSSH\n2018.11.16  OpenSSH fixed vulnerability #1\n2019.01.07  requested a status update from OpenSSH\n2019.01.08  requested CVE assignments from MITRE\n2019.01.10  received CVE assignments from MITRE\n2019.01.11  public disclosure of the advisory\n2019.01.14  added a warning about the potential issues caused by the patch\n\n\n. All the vulnerabilities\nare in found in the scp client implementing the SCP protocol. \n    The check added in this version can lead to regression if the client and\n    the server have differences in wildcard expansion rules. If the server is\n    trusted for that purpose, the check can be disabled with a new -T option to\n    the scp client. \n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1:7.4p1-10+deb9u5. \n\nFor the detailed security status of openssh please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/openssh\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAlxe0w0ACgkQ3rYcyPpX\nRFs85AgA0GrSHO4Qf5FVsE3oXa+nMkZ4U6pbOA9dHotX54DEyNuIJrOsOv01cFxQ\nt2Z6uDkZptmHZT4uSWg2xIgMvpkGo9906ziZfHc0LTuHl8j++7cCDIDGZBm/iZaX\nueQfl85gHDpte41JvUtpSBAwk1Bic7ltLUPDIGEiq6nQboxHIzsU7ULVb1l0wNxF\nsEFDPWGBS01HTa+QWgQaG/wbEhMRDcVz1Ck7dqpT2soQRohDWxU01j14q1EKe9O9\nGHiWECvFSHBkkI/v8lNfSWnOWYa/+Aknri0CpjPc/bqh2Yx9rgp/Q5+FJ/FxJjmC\nbHFd+tbxB1LxEO96zKguYpPIzw7Kcw==\n=5Fd8\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6109"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "db": "BID",
        "id": "106843"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-6109"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      }
    ],
    "trust": 2.34
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-6109",
        "trust": 3.2
      },
      {
        "db": "SIEMENS",
        "id": "SSA-412672",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "152154",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.1255",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1280.2",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1280",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.1270",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0410.3",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0605",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.3698",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.1420",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-467",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "106843",
        "trust": 0.3
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-349-21",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-6109",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "155158",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "151175",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "151601",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6109"
      },
      {
        "db": "BID",
        "id": "106843"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6109"
      }
    ]
  },
  "id": "VAR-201901-0010",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.64041158
  },
  "last_update_date": "2024-11-23T20:22:31.569000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVS log for src/usr.bin/ssh/progressmeter.c",
        "trust": 0.8,
        "url": "https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c"
      },
      {
        "title": "CVS log for src/usr.bin/ssh/scp.c",
        "trust": 0.8,
        "url": "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c"
      },
      {
        "title": "OpenSSH Security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=88613"
      },
      {
        "title": "The Register",
        "trust": 0.2,
        "url": "https://www.theregister.co.uk/2019/01/15/scp_vulnerability/"
      },
      {
        "title": "Red Hat: Moderate: openssh security, bug fix, and enhancement update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20193702 - Security Advisory"
      },
      {
        "title": "Ubuntu Security Notice: openssh vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3885-1"
      },
      {
        "title": "Debian CVElist Bug Report Logs: openssh-client: scp can send arbitrary control characters / escape sequences to the terminal (CVE-2019-6109)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=dffe92fd93b8f745f5f15bc2f29dc935"
      },
      {
        "title": "Debian CVElist Bug Report Logs: CVE-2019-6111 not fixed, file transfer of unwanted files by malicious SSH server still possible",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=74b791ca4fdf54c27d2b50ef6845ef8e"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2019-6109"
      },
      {
        "title": "Debian CVElist Bug Report Logs: openssh: CVE-2018-20685: scp.c in the scp client allows remote SSH servers to bypass intended access restrictions",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=8394bb17731a99ef76b185cbc70acfa3"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2019-1313",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2019-1313"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2019-1216",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2019-1216"
      },
      {
        "title": "IBM: IBM Security Bulletin: Vulnerabilities in OpenSSH affect AIX (CVE-2018-20685 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111) Security Bulletin",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=50a54c2fb43b489f64442dcf4f25bc3b"
      },
      {
        "title": "IBM: Security Bulletin: Multiple vulnerabilities affect IBM Cloud Object Storage Systems (February 2020v1)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=979e60202a29c3c55731e37f8ddc5a3b"
      },
      {
        "title": "IBM: IBM Security Bulletin: Vyatta 5600 vRouter Software Patches \u2013 Releases 1801-w and 1801-y",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=bf3f2299a8658b7cd3984c40e7060666"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=ec6577109e640dac19a6ddb978afe82d"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Live-Hack-CVE/CVE-2019-6109 "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/h4xrOx/Direct-Admin-Vulnerability-Disclosure "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/numaan911098/leadgenapp-bug-report "
      },
      {
        "title": "DC-4-Vulnhub-Walkthrough",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/DC-4-Vulnhub-Walkthrough "
      },
      {
        "title": "nmap",
        "trust": 0.1,
        "url": "https://github.com/devairdarolt/nmap "
      },
      {
        "title": "TrivyWeb",
        "trust": 0.1,
        "url": "https://github.com/KorayAgaya/TrivyWeb "
      },
      {
        "title": "github_aquasecurity_trivy",
        "trust": 0.1,
        "url": "https://github.com/back8/github_aquasecurity_trivy "
      },
      {
        "title": "Funbox2-rookie",
        "trust": 0.1,
        "url": "https://github.com/vaishali1998/Funbox2-rookie "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/simiyo/trivy "
      },
      {
        "title": "security",
        "trust": 0.1,
        "url": "https://github.com/umahari/security "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/Mohzeela/external-secret "
      },
      {
        "title": "Vulnerability-Scanner-for-Containers",
        "trust": 0.1,
        "url": "https://github.com/t31m0/Vulnerability-Scanner-for-Containers "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/aquasecurity/trivy "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/knqyf263/trivy "
      },
      {
        "title": "trivy",
        "trust": 0.1,
        "url": "https://github.com/siddharthraopotukuchi/trivy "
      },
      {
        "title": "Basic-Pentesting-2-Vulnhub-Walkthrough",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/Basic-Pentesting-2-Vulnhub-Walkthrough "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/bioly230/THM_Skynet "
      },
      {
        "title": "Basic-Pentesting-2",
        "trust": 0.1,
        "url": "https://github.com/vshaliii/Basic-Pentesting-2 "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6109"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-116",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-284",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6109"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "https://access.redhat.com/errata/rhsa-2019:3702"
      },
      {
        "trust": 2.3,
        "url": "https://www.debian.org/security/2019/dsa-4387"
      },
      {
        "trust": 2.1,
        "url": "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt"
      },
      {
        "trust": 1.8,
        "url": "https://usn.ubuntu.com/3885-1/"
      },
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/201903-16"
      },
      {
        "trust": 1.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6109"
      },
      {
        "trust": 1.7,
        "url": "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c"
      },
      {
        "trust": 1.7,
        "url": "https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c"
      },
      {
        "trust": 1.7,
        "url": "https://security.netapp.com/advisory/ntap-20190213-0001/"
      },
      {
        "trust": 1.7,
        "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
      },
      {
        "trust": 1.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/w3yvq2bptovdcfdvnc2ggf5p5isfg37g/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6109"
      },
      {
        "trust": 0.6,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/w3yvq2bptovdcfdvnc2ggf5p5isfg37g/"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914030-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190941-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190496-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914016-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/76170"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/152154/gentoo-linux-security-advisory-201903-16.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/75338"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1280.2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.3698"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/78994"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1280/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/78934"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/79690"
      },
      {
        "trust": 0.6,
        "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10882554"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-6109"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6111"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20685"
      },
      {
        "trust": 0.3,
        "url": "http://www.openssh.org/"
      },
      {
        "trust": 0.3,
        "url": "https://support.f5.com/csp/article/k12252011"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6110"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/116.html"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=59542"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-21"
      },
      {
        "trust": 0.1,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-6111"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-20685"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20684"
      },
      {
        "trust": 0.1,
        "url": "https://sintonen.fi/advisories/scp-name-validator.patch"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2000-0992"
      },
      {
        "trust": 0.1,
        "url": "https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/openssh"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6109"
      },
      {
        "db": "BID",
        "id": "106843"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6109"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2019-6109"
      },
      {
        "db": "BID",
        "id": "106843"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6109"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-01-31T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-6109"
      },
      {
        "date": "2019-01-11T00:00:00",
        "db": "BID",
        "id": "106843"
      },
      {
        "date": "2019-02-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "date": "2019-03-20T16:09:02",
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "date": "2019-11-06T15:55:27",
        "db": "PACKETSTORM",
        "id": "155158"
      },
      {
        "date": "2019-01-16T15:04:39",
        "db": "PACKETSTORM",
        "id": "151175"
      },
      {
        "date": "2019-02-11T16:13:15",
        "db": "PACKETSTORM",
        "id": "151601"
      },
      {
        "date": "2019-01-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      },
      {
        "date": "2019-01-31T18:29:00.710000",
        "db": "NVD",
        "id": "CVE-2019-6109"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-6109"
      },
      {
        "date": "2019-01-11T00:00:00",
        "db": "BID",
        "id": "106843"
      },
      {
        "date": "2019-02-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      },
      {
        "date": "2022-12-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      },
      {
        "date": "2024-11-21T04:45:57.517000",
        "db": "NVD",
        "id": "CVE-2019-6109"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "152154"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenSSH Access control vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001217"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "access control error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201901-467"
      }
    ],
    "trust": 0.6
  }
}

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

7 vulnerabilities found for m10-4s by fujitsu

VAR-202012-1278

Synopsis

Background

Affected packages

Description

Impact

Workaround

Resolution

References

Availability

Concerns?

License

curl vulnerabilities

VAR-201303-0327

Background

firefox vulnerabilities

Background

Affected packages

Description

Impact

Workaround

Resolution

References

Availability

Concerns?

License

VAR-202012-1277

curl vulnerabilities

VAR-201711-0007

6.

gnutls26 vulnerability

VAR-201901-1500

openssh vulnerabilities

Synopsis

Affected packages

Description

Workaround

Resolution

References

Availability

Concerns?

License

Overview

Description

Details

Vulnerabilities

Proof-of-Concept

Vulnerable versions

Mitigation

Similar or prior work

References

Credits

Timeline

VAR-201901-0012

Synopsis

Affected packages

Description

Workaround

Resolution

References

Availability

Concerns?

License

Description

Details

Vulnerabilities

Proof-of-Concept

Vulnerable versions

Mitigation

Similar or prior work

Credits

Timeline

openssh vulnerability

VAR-201901-0010

Synopsis

Workaround

Resolution

References

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.