Find a vulnerability

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

60 vulnerabilities found for secure_backup by oracle

CVE-2025-21578 (GCVE-0-2025-21578)

Vulnerability from nvd – Published: 2025-04-15 20:30 – Updated: 2026-02-26 18:28

Summary

Vulnerability in Oracle Secure Backup (component: General). Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and 18.1.0.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup.
CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuapr2025.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Oracle Secure Backup	Affected: 12.1.0.1 (semver) Affected: 12.1.0.2 (semver) Affected: 12.1.0.3 (semver) Affected: 18.1.0.0 (semver) Affected: 18.1.0.1 (semver) Affected: 18.1.0.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-21578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T03:55:21.167093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-732",
                "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T18:28:22.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Secure Backup",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "12.1.0.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.1.0.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.1.0.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "18.1.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "18.1.0.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "18.1.0.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:12.1.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:12.1.0.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:12.1.0.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:18.1.0.0:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:18.1.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:18.1.0.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in Oracle Secure Backup (component: General).  Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and  18.1.0.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-15T20:30:54.774Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2025.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2025-21578",
    "datePublished": "2025-04-15T20:30:54.774Z",
    "dateReserved": "2024-12-24T23:18:54.785Z",
    "dateUpdated": "2026-02-26T18:28:22.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-42013 (GCVE-0-2021-42013)

Vulnerability from nvd – Published: 2021-10-07 15:50 – Updated: 2025-10-21 23:25

CISA KEVIntel

Title

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

Summary

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

apache

References

31 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	x_refsource_MISC
https://lists.apache.org/thread.html/r7c795cd45a3…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb5b0e46f179…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/07/6	mailing-listx_refsource_MLIST
https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
http://jvn.jp/en/jp/JVN51106450/index.html	third-party-advisoryx_refsource_JVN
http://www.openwall.com/lists/oss-security/2021/10/08/1	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r17a4c6ce9af…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/2	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/3	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/4	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/6	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/5	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/09/1	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/11/4	mailing-listx_refsource_MLIST
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
http://www.openwall.com/lists/oss-security/2021/10/15/3	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/16/1	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2021102…	x_refsource_CONFIRM
http://packetstormsecurity.com/files/164629/Apach…	x_refsource_MISC
http://packetstormsecurity.com/files/164941/Apach…	x_refsource_MISC
http://packetstormsecurity.com/files/164501/Apach…	x_refsource_MISC
http://packetstormsecurity.com/files/164609/Apach…	x_refsource_MISC
http://packetstormsecurity.com/files/165089/Apach…	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
http://packetstormsecurity.com/files/167397/Apach…	x_refsource_MISC
https://www.povilaika.com/apache-2-4-50-exploit/	x_refsource_MISC
https://security.gentoo.org/glsa/202208-20	vendor-advisoryx_refsource_GENTOO
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: Apache HTTP Server 2.4.49 Affected: Apache HTTP Server 2.4.50

Credits

Reported by Juan Escobar from Dreamlab Technologies, Fernando Muñoz from NULL Life CTF Team, and Shungo Kumasaka

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:22:25.641Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "name": "[announce] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E"
          },
          {
            "name": "[httpd-users] 20211007 [users@httpd] CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/07/6"
          },
          {
            "name": "20211007 Apache HTTP Server Vulnerabilties: October 2021",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"
          },
          {
            "name": "JVN#51106450",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN51106450/index.html"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/1"
          },
          {
            "name": "[httpd-cvs] 20211008 [httpd-site] branch main updated: * Align with CVE-2021-42013 based on the latest findings",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/2"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/3"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/4"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/6"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/5"
          },
          {
            "name": "[oss-security] 20211009 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/09/1"
          },
          {
            "name": "[oss-security] 20211011 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/11/4"
          },
          {
            "name": "FEDORA-2021-2a10bc68a4",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"
          },
          {
            "name": "FEDORA-2021-aaf90ef84a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/"
          },
          {
            "name": "[oss-security] 20211015 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/15/3"
          },
          {
            "name": "[oss-security] 20211016 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/16/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211029-0009/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.povilaika.com/apache-2-4-50-exploit/"
          },
          {
            "name": "GLSA-202208-20",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202208-20"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-42013",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T14:28:39.366525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:30.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00.000Z",
            "value": "CVE-2021-42013 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "Apache HTTP Server 2.4.49"
            },
            {
              "status": "affected",
              "version": "Apache HTTP Server 2.4.50"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported by Juan Escobar from Dreamlab Technologies, Fernando Mu\u00f1oz from NULL Life CTF Team, and Shungo Kumasaka"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "critical"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-14T01:06:15.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "name": "[announce] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E"
        },
        {
          "name": "[httpd-users] 20211007 [users@httpd] CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/07/6"
        },
        {
          "name": "20211007 Apache HTTP Server Vulnerabilties: October 2021",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"
        },
        {
          "name": "JVN#51106450",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN51106450/index.html"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/1"
        },
        {
          "name": "[httpd-cvs] 20211008 [httpd-site] branch main updated: * Align with CVE-2021-42013 based on the latest findings",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/2"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/3"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/4"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/6"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/5"
        },
        {
          "name": "[oss-security] 20211009 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/09/1"
        },
        {
          "name": "[oss-security] 20211011 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/11/4"
        },
        {
          "name": "FEDORA-2021-2a10bc68a4",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"
        },
        {
          "name": "FEDORA-2021-aaf90ef84a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/"
        },
        {
          "name": "[oss-security] 20211015 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/15/3"
        },
        {
          "name": "[oss-security] 20211016 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/16/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211029-0009/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.povilaika.com/apache-2-4-50-exploit/"
        },
        {
          "name": "GLSA-202208-20",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202208-20"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2021-10-06T00:00:00.000Z",
          "value": "reported"
        }
      ],
      "title": "Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-42013",
          "STATE": "PUBLIC",
          "TITLE": "Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "Apache HTTP Server",
                            "version_value": "2.4.49"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "Apache HTTP Server",
                            "version_value": "2.4.50"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Reported by Juan Escobar from Dreamlab Technologies, Fernando Mu\u00f1oz from NULL Life CTF Team, and Shungo Kumasaka"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "critical"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "[announce] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E"
            },
            {
              "name": "[httpd-users] 20211007 [users@httpd] CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/07/6"
            },
            {
              "name": "20211007 Apache HTTP Server Vulnerabilties: October 2021",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"
            },
            {
              "name": "JVN#51106450",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN51106450/index.html"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/1"
            },
            {
              "name": "[httpd-cvs] 20211008 [httpd-site] branch main updated: * Align with CVE-2021-42013 based on the latest findings",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/2"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/3"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/4"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/6"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/5"
            },
            {
              "name": "[oss-security] 20211009 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/09/1"
            },
            {
              "name": "[oss-security] 20211011 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/11/4"
            },
            {
              "name": "FEDORA-2021-2a10bc68a4",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"
            },
            {
              "name": "FEDORA-2021-aaf90ef84a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/"
            },
            {
              "name": "[oss-security] 20211015 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/15/3"
            },
            {
              "name": "[oss-security] 20211016 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/16/1"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211029-0009/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211029-0009/"
            },
            {
              "name": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html"
            },
            {
              "name": "https://www.povilaika.com/apache-2-4-50-exploit/",
              "refsource": "MISC",
              "url": "https://www.povilaika.com/apache-2-4-50-exploit/"
            },
            {
              "name": "GLSA-202208-20",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202208-20"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2021-10-06T00:00:00.000Z",
            "value": "reported"
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-42013",
    "datePublished": "2021-10-07T15:50:14.000Z",
    "dateReserved": "2021-10-06T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:30.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3712 (GCVE-0-2021-3712)

Vulnerability from nvd – Published: 2021-08-24 14:50 – Updated: 2026-04-16 14:11

Title

Read buffer overruns processing ASN.1 strings

Summary

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Buffer overflow
CWE-125 - Out-of-bounds Read

Assigner

openssl

References

25 references

URL	Tags
https://www.openssl.org/news/secadv/20210824.txt
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…
https://www.debian.org/security/2021/dsa-4963	vendor-advisory
https://lists.apache.org/thread.html/r18995de860f…	mailing-list
http://www.openwall.com/lists/oss-security/2021/08/26/2	mailing-list
https://lists.apache.org/thread.html/rad5d9f83f0d…	mailing-list
https://security.netapp.com/advisory/ntap-2021082…
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.tenable.com/security/tns-2021-16
https://kc.mcafee.com/corporate/index?page=conten…
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.tenable.com/security/tns-2022-02
https://www.oracle.com/security-alerts/cpuapr2022.html
https://cert-portal.siemens.com/productcert/pdf/s…
https://cert-portal.siemens.com/productcert/pdf/s…
https://security.gentoo.org/glsa/202209-02	vendor-advisory
https://security.gentoo.org/glsa/202210-02	vendor-advisory
https://security.netapp.com/advisory/ntap-2024062…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

210 products

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k) Affected: Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)
Siemens	BFCClient	Affected: 0 , < V2.17 (custom)
Siemens	Industrial Edge - Machine Insight App	Affected: 0 , < * (custom)
Siemens	Industrial Edge - PROFINET IO Connector	Affected: All versions < V1.1.1
Siemens	RUGGEDCOM RM1224 LTE(4G) EU	Affected: All versions < V7.1
Siemens	RUGGEDCOM RM1224 LTE(4G) NAM	Affected: All versions < V7.1
Siemens	RUGGEDCOM ROX MX5000	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX MX5000RE	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1400	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1500	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1501	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1510	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1511	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1512	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1524	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1536	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX5000	Affected: 0 , < V2.15.0 (custom)
Siemens	SCALANCE M804PB	Affected: All versions < V7.1
Siemens	SCALANCE M812-1 ADSL-Router	Affected: All versions < V7.1
Siemens	SCALANCE M816-1 ADSL-Router	Affected: All versions < V7.1
Siemens	SCALANCE M826-2 SHDSL-Router	Affected: All versions < V7.1
Siemens	SCALANCE M874-2	Affected: All versions < V7.1
Siemens	SCALANCE M874-3	Affected: All versions < V7.1
Siemens	SCALANCE M876-3	Affected: All versions < V7.1
Siemens	SCALANCE M876-3 (ROK)	Affected: All versions < V7.1
Siemens	SCALANCE M876-4 (EU)	Affected: All versions < V7.1
Siemens	SCALANCE M876-4 (NAM)	Affected: All versions < V7.1
Siemens	SCALANCE MUM853-1 (EU)	Affected: 0 , < V7.1 (custom)
Siemens	SCALANCE MUM856-1 (EU)	Affected: 0 , < V7.1 (custom)
Siemens	SCALANCE MUM856-1 (RoW)	Affected: 0 , < V7.1 (custom)
Siemens	SCALANCE S615 LAN-Router	Affected: All versions < V7.1
Siemens	SCALANCE SC622-2C	Affected: All versions < V2.3
Siemens	SCALANCE SC632-2C	Affected: All versions < V2.3
Siemens	SCALANCE SC636-2C	Affected: All versions < V2.3
Siemens	SCALANCE SC642-2C	Affected: All versions < V2.3
Siemens	SCALANCE SC646-2C	Affected: All versions < V2.3
Siemens	SCALANCE W1748-1 M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W1788-1 M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W1788-2 EEC M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W1788-2 M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W1788-2IA M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W721-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W722-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W734-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W734-1 RJ45 (USA)	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W738-1 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W748-1 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W748-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W761-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W774-1 M12 EEC	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W774-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W774-1 RJ45 (USA)	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W778-1 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W778-1 M12 EEC	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W778-1 M12 EEC (USA)	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W786-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W786-2 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W786-2 SFP	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W786-2IA RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-1 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-2 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-2 M12 EEC	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-2 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE WAM766-1	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WAM766-1 (US)	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WAM766-1 EEC	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WAM766-1 EEC (US)	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WUM766-1	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WUM766-1 (USA)	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE X200-4P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X201-3P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X201-3P IRT PRO	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X202-2IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X202-2P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X202-2P IRT PRO	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X204-2	Affected: All versions < V5.2.6
Siemens	SCALANCE X204-2FM	Affected: All versions < V5.2.6
Siemens	SCALANCE X204-2LD	Affected: All versions < V5.2.6
Siemens	SCALANCE X204-2LD TS	Affected: All versions < V5.2.6
Siemens	SCALANCE X204-2TS	Affected: All versions < V5.2.6
Siemens	SCALANCE X204IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X204IRT PRO	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X206-1	Affected: All versions < V5.2.6
Siemens	SCALANCE X206-1LD	Affected: All versions < V5.2.6
Siemens	SCALANCE X208	Affected: All versions < V5.2.6
Siemens	SCALANCE X208PRO	Affected: All versions < V5.2.6
Siemens	SCALANCE X212-2	Affected: All versions < V5.2.6
Siemens	SCALANCE X212-2LD	Affected: All versions < V5.2.6
Siemens	SCALANCE X216	Affected: All versions < V5.2.6
Siemens	SCALANCE X224	Affected: All versions < V5.2.6
Siemens	SCALANCE X302-7 EEC (230V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (230V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (24V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (2x 230V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (2x 230V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (2x 24V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (2x 24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X304-2FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X306-1LD FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (230V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (230V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (24V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (2x 230V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (2x 230V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (2x 24V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (2x 24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-3	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-3LD	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2LD	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2LH	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2LH+	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2M	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2M PoE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2M TS	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X310	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X310FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X320-1 FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X320-1-2LD FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X408-2	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XF201-3P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE XF202-2P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE XF204	Affected: All versions < V5.2.6
Siemens	SCALANCE XF204-2	Affected: All versions < V5.2.6
Siemens	SCALANCE XF204-2BA IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE XF204IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE XF206-1	Affected: All versions < V5.2.6
Siemens	SCALANCE XF208	Affected: All versions < V5.2.6
Siemens	SCALANCE XR324-12M (230V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-12M (230V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-12M (24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-12M (24V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-12M TS (24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (24V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (2x 24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (2x 24V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE (230V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE (230V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE (24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE (24V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE TS (24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SIMATIC CP 1242-7 V2	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1243-1	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1243-7 LTE EU	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1243-7 LTE US	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1243-8 IRC	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1542SP-1	Affected: 0 , < V2.2.28 (custom)
Siemens	SIMATIC CP 1543-1	Affected: All versions < V3.0.22
Siemens	SIMATIC CP 1543SP-1	Affected: 0 , < V2.2.28 (custom)
Siemens	SIMATIC CP 1545-1	Affected: All versions < V1.1
Siemens	SIMATIC PCS neo (Administration Console)	Affected: 0 , < V3.1.1 (custom)
Siemens	SIMATIC Process Historian OPC UA Server	Affected: 0 , < V2020 SP1 (custom)
Siemens	SIMATIC S7-1200 CPU 1211C AC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1211C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1211C DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212C AC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212C DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212FC DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214C AC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214C DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214FC DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215C AC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215C DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215FC DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1217C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SINEC NMS	Affected: 0 , < V1.0 SP3 (custom)
Siemens	SINEMA Remote Connect Server	Affected: 0 , < V3.1 (custom)
Siemens	SINEMA Server V14	Affected: 0 , < * (custom)
Siemens	SINUMERIK Operate	Affected: All versions < V4.95 SP1
Siemens	SIPLUS ET 200SP CP 1543SP-1 ISEC	Affected: 0 , < V2.2.28 (custom)
Siemens	SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL	Affected: 0 , < V2.2.28 (custom)
Siemens	SIPLUS NET CP 1242-7 V2	Affected: All versions < V3.3.46
Siemens	SIPLUS NET CP 1543-1	Affected: All versions < V3.0.22
Siemens	SIPLUS NET SCALANCE X308-2	Affected: 0 , < V4.1.4 (custom)
Siemens	SIPLUS S7-1200 CP 1243-1	Affected: All versions < V3.3.46
Siemens	SIPLUS S7-1200 CP 1243-1 RAIL	Affected: All versions < V3.3.46
Siemens	SIPLUS S7-1200 CPU 1212 AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1212 DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1212C AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214 AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214 DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214C AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214FC DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215 AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215C AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	TIA Administrator	Affected: 0 , < V1.0.7 (custom)

Date Public

2021-08-24 00:00

Credits

Ingo Schwarze

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:08.180Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20210824.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12"
          },
          {
            "name": "DSA-4963",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4963"
          },
          {
            "name": "[tomcat-dev] 20210825 OpenSSL security announcement - do we need a Tomcat Native release?",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210825 OpenSSL SM2 Decryption Buffer Overflow (CVE-2021-3711), Read buffer overruns processing ASN.1 strings (CVE-2021-3712)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/08/26/2"
          },
          {
            "name": "[tomcat-dev] 20210826 Re: OpenSSL security announcement - do we need a Tomcat Native release?",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210827-0010/"
          },
          {
            "name": "[debian-lts-announce] 20210926 [SECURITY] [DLA 2766-1] openssl security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html"
          },
          {
            "name": "[debian-lts-announce] 20210930 [SECURITY] [DLA 2774-1] openssl1.0 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2022-02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf"
          },
          {
            "name": "GLSA-202209-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-02"
          },
          {
            "name": "GLSA-202210-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "BFCClient",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge - Machine Insight App",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge - PROFINET IO Connector",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V1.1.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RM1224 LTE(4G) EU",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RM1224 LTE(4G) NAM",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000RE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1400",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1500",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1501",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1510",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1511",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1512",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1524",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1536",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M804PB",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M812-1 ADSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M812-1 ADSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M816-1 ADSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M816-1 ADSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M826-2 SHDSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M874-2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M874-3",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M876-3",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M876-3 (ROK)",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M876-4 (EU)",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M876-4 (NAM)",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE MUM853-1 (EU)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V7.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE MUM856-1 (EU)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V7.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE MUM856-1 (RoW)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V7.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE S615 LAN-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC622-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC632-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC636-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC642-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC646-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1788-2 EEC M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1788-2IA M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W721-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W721-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W721-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W721-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W738-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W738-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W738-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W738-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W761-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W761-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W761-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W761-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12 EEC (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12 EEC (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 SFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 SFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 SFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 SFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2IA RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2IA RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2IA RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2IA RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WAM766-1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WAM766-1 (US)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WAM766-1 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WAM766-1 EEC (US)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WUM766-1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WUM766-1 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X200-4P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X201-3P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X201-3P IRT PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X202-2IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X202-2P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X202-2P IRT PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2FM",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2LD",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2LD TS",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2TS",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204IRT PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X206-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X206-1LD",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X208",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X208PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X212-2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X212-2LD",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X216",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X224",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (230V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (230V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (24V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (2x 230V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (2x 230V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (2x 24V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (2x 24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X304-2FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X306-1LD FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (230V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (230V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (24V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (2x 230V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (2x 230V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (2x 24V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (2x 24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-3",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-3",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-3LD",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-3LD",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LD",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LD",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LH",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LH",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LH+",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LH+",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M PoE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M PoE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M TS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M TS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X310",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X310",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X310FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X310FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X320-1 FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X320-1-2LD FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X408-2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF201-3P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF202-2P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF204",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF204-2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF204-2BA IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF204IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF206-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF208",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (230V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (230V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (230V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (230V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M TS (24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M TS (24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE (230V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE (230V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE TS (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1242-7 V2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1243-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1243-7 LTE EU",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1243-7 LTE US",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1243-8 IRC",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1542SP-1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1543-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.0.22"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1543SP-1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1545-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V1.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC PCS neo (Administration Console)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC Process Historian OPC UA Server",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2020 SP1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1211C AC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1211C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1211C DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212C AC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212C DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212FC DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214C AC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214C DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214FC DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215C AC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215C DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215FC DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1217C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SINEC NMS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.0 SP3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SINEMA Remote Connect Server",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SINEMA Server V14",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SINUMERIK Operate",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c  V4.95 SP1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS ET 200SP CP 1543SP-1 ISEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS NET CP 1242-7 V2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS NET CP 1543-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.0.22"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS NET SCALANCE X308-2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CP 1243-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CP 1243-1 RAIL",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212 AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212C AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214 AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214FC DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215C AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "TIA Administrator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.0.7",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-14T08:57:51.339Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-244969.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-389290.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-028723.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019200.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-3712",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T14:11:09.557845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T14:11:16.454Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k)"
            },
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ingo Schwarze"
        }
      ],
      "datePublic": "2021-08-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL\u0027s own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#Moderate",
              "value": "Moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Buffer overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:21.902Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "url": "https://www.openssl.org/news/secadv/20210824.txt"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12"
        },
        {
          "name": "DSA-4963",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4963"
        },
        {
          "name": "[tomcat-dev] 20210825 OpenSSL security announcement - do we need a Tomcat Native release?",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210825 OpenSSL SM2 Decryption Buffer Overflow (CVE-2021-3711), Read buffer overruns processing ASN.1 strings (CVE-2021-3712)",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/08/26/2"
        },
        {
          "name": "[tomcat-dev] 20210826 Re: OpenSSL security announcement - do we need a Tomcat Native release?",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210827-0010/"
        },
        {
          "name": "[debian-lts-announce] 20210926 [SECURITY] [DLA 2766-1] openssl security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html"
        },
        {
          "name": "[debian-lts-announce] 20210930 [SECURITY] [DLA 2774-1] openssl1.0 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-16"
        },
        {
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "url": "https://www.tenable.com/security/tns-2022-02"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf"
        },
        {
          "name": "GLSA-202209-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-02"
        },
        {
          "name": "GLSA-202210-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-02"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ],
      "title": "Read buffer overruns processing ASN.1 strings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2021-3712",
    "datePublished": "2021-08-24T14:50:14.704Z",
    "dateReserved": "2021-08-16T00:00:00.000Z",
    "dateUpdated": "2026-04-16T14:11:16.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-33193 (GCVE-0-2021-33193)

Vulnerability from nvd – Published: 2021-08-16 00:00 – Updated: 2024-08-03 23:42

Title

Request splitting via HTTP/2 method injection and mod_proxy

Summary

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

Severity

No CVSS data available.

CWE

Request Splitting

Assigner

apache

References

13 references

URL	Tags
https://portswigger.net/research/http2
https://github.com/apache/httpd/commit/ecebcc035c…
https://lists.apache.org/thread.html/re4162adc051…	mailing-list
https://lists.apache.org/thread.html/ree7519d7141…	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://tools.cisco.com/security/center/content/C…	vendor-advisory
https://www.oracle.com/security-alerts/cpujan2022.html
https://security.netapp.com/advisory/ntap-2021091…
https://www.tenable.com/security/tns-2021-17
https://www.oracle.com/security-alerts/cpuapr2022.html
https://security.gentoo.org/glsa/202208-20	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: Apache HTTP Server 2.4 2.4.17 to 2.4.48

Credits

Reported by James Kettle of PortSwigger

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:42:20.253Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://portswigger.net/research/http2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch"
          },
          {
            "name": "[httpd-cvs] 20210916 [httpd-site] branch main updated: Revert \"Add descriptions for CVE-2021-33193 CVE-2021-36160\"",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210916 [httpd-site] branch main updated: Add descriptions for CVE-2021-33193 CVE-2021-36160",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "FEDORA-2021-5d2d4b6ac5",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/"
          },
          {
            "name": "FEDORA-2021-f94985afca",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/"
          },
          {
            "name": "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210917-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "name": "GLSA-202208-20",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202208-20"
          },
          {
            "name": "[debian-lts-announce] 20230303 [SECURITY] [DLA 3351-1] apache2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "Apache HTTP Server 2.4 2.4.17 to 2.4.48"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported by James Kettle of PortSwigger"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Request Splitting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-03T00:00:00.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "url": "https://portswigger.net/research/http2"
        },
        {
          "url": "https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch"
        },
        {
          "name": "[httpd-cvs] 20210916 [httpd-site] branch main updated: Revert \"Add descriptions for CVE-2021-33193 CVE-2021-36160\"",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-cvs] 20210916 [httpd-site] branch main updated: Add descriptions for CVE-2021-33193 CVE-2021-36160",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "FEDORA-2021-5d2d4b6ac5",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/"
        },
        {
          "name": "FEDORA-2021-f94985afca",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/"
        },
        {
          "name": "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210917-0004/"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-17"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "name": "GLSA-202208-20",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202208-20"
        },
        {
          "name": "[debian-lts-announce] 20230303 [SECURITY] [DLA 3351-1] apache2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00002.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2021-05-11T00:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2021-08-06T00:00:00.000Z",
          "value": "public"
        }
      ],
      "title": "Request splitting via HTTP/2 method injection and mod_proxy",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-33193",
    "datePublished": "2021-08-16T00:00:00.000Z",
    "dateReserved": "2021-05-19T00:00:00.000Z",
    "dateUpdated": "2024-08-03T23:42:20.253Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26691 (GCVE-0-2021-26691)

Vulnerability from nvd – Published: 2021-06-10 07:10 – Updated: 2024-08-03 20:33

Title

Apache HTTP Server mod_session response handling heap overflow

Summary

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

Severity

No CVSS data available.

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

apache

References

13 references

URL	Tags
http://httpd.apache.org/security/vulnerabilities_…	x_refsource_MISC
https://lists.apache.org/thread.html/re026d3da9d7…	x_refsource_MISC
https://lists.apache.org/thread.html/r50cae1b71f1…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r7f2b70b6216…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/06/10/7	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2021/dsa-4937	vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/202107-38	vendor-advisoryx_refsource_GENTOO
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2021070…	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.46 Affected: 2.4.43 Affected: 2.4.41 Affected: 2.4.39 Affected: 2.4.38 Affected: 2.4.37 Affected: 2.4.35 Affected: 2.4.34 Affected: 2.4.33 Affected: 2.4.29 Affected: 2.4.28 Affected: 2.4.27 Affected: 2.4.26 Affected: 2.4.25 Affected: 2.4.23 Affected: 2.4.20 Affected: 2.4.18 Affected: 2.4.17 Affected: 2.4.16 Affected: 2.4.12 Affected: 2.4.10 Affected: 2.4.9 Affected: 2.4.7 Affected: 2.4.6 Affected: 2.4.4 Affected: 2.4.3 Affected: 2.4.2 Affected: 2.4.1 Affected: 2.4.0

Credits

Discovered internally Christophe Jaillet

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:33:40.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/06/10/7"
          },
          {
            "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
          },
          {
            "name": "DSA-4937",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4937"
          },
          {
            "name": "GLSA-202107-38",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-38"
          },
          {
            "name": "FEDORA-2021-dce7e7738e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
          },
          {
            "name": "FEDORA-2021-e3f6dd670d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.46"
            },
            {
              "status": "affected",
              "version": "2.4.43"
            },
            {
              "status": "affected",
              "version": "2.4.41"
            },
            {
              "status": "affected",
              "version": "2.4.39"
            },
            {
              "status": "affected",
              "version": "2.4.38"
            },
            {
              "status": "affected",
              "version": "2.4.37"
            },
            {
              "status": "affected",
              "version": "2.4.35"
            },
            {
              "status": "affected",
              "version": "2.4.34"
            },
            {
              "status": "affected",
              "version": "2.4.33"
            },
            {
              "status": "affected",
              "version": "2.4.29"
            },
            {
              "status": "affected",
              "version": "2.4.28"
            },
            {
              "status": "affected",
              "version": "2.4.27"
            },
            {
              "status": "affected",
              "version": "2.4.26"
            },
            {
              "status": "affected",
              "version": "2.4.25"
            },
            {
              "status": "affected",
              "version": "2.4.23"
            },
            {
              "status": "affected",
              "version": "2.4.20"
            },
            {
              "status": "affected",
              "version": "2.4.18"
            },
            {
              "status": "affected",
              "version": "2.4.17"
            },
            {
              "status": "affected",
              "version": "2.4.16"
            },
            {
              "status": "affected",
              "version": "2.4.12"
            },
            {
              "status": "affected",
              "version": "2.4.10"
            },
            {
              "status": "affected",
              "version": "2.4.9"
            },
            {
              "status": "affected",
              "version": "2.4.7"
            },
            {
              "status": "affected",
              "version": "2.4.6"
            },
            {
              "status": "affected",
              "version": "2.4.4"
            },
            {
              "status": "affected",
              "version": "2.4.3"
            },
            {
              "status": "affected",
              "version": "2.4.2"
            },
            {
              "status": "affected",
              "version": "2.4.1"
            },
            {
              "status": "affected",
              "version": "2.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Discovered internally Christophe Jaillet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "low"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-07T14:41:53.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/06/10/7"
        },
        {
          "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
        },
        {
          "name": "DSA-4937",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4937"
        },
        {
          "name": "GLSA-202107-38",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-38"
        },
        {
          "name": "FEDORA-2021-dce7e7738e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
        },
        {
          "name": "FEDORA-2021-e3f6dd670d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache HTTP Server mod_session response handling heap overflow",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-26691",
          "STATE": "PUBLIC",
          "TITLE": "Apache HTTP Server mod_session response handling heap overflow"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.46"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.43"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.41"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.39"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.38"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.37"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.35"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.34"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.33"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.29"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.28"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.27"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.26"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.25"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.23"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.20"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.18"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.17"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.16"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.12"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.10"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.9"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.7"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.6"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.4"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.3"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.2"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.1"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Discovered internally Christophe Jaillet"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "low"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-122 Heap-based Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe@%3Cannounce.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/06/10/7"
            },
            {
              "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
            },
            {
              "name": "DSA-4937",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4937"
            },
            {
              "name": "GLSA-202107-38",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-38"
            },
            {
              "name": "FEDORA-2021-dce7e7738e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
            },
            {
              "name": "FEDORA-2021-e3f6dd670d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210702-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-26691",
    "datePublished": "2021-06-10T07:10:23.000Z",
    "dateReserved": "2021-02-04T00:00:00.000Z",
    "dateUpdated": "2024-08-03T20:33:40.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3450 (GCVE-0-2021-3450)

Vulnerability from nvd – Published: 2021-03-25 14:25 – Updated: 2024-09-17 03:07

Title

CA certificate check bypass with X509_V_FLAG_X509_STRICT

Summary

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).

Severity

No CVSS data available.

CWE

Invalid Certificate Verification

Assigner

openssl

References

24 references

URL	Tags
https://www.openssl.org/news/secadv/20210325.txt	x_refsource_CONFIRM
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…	x_refsource_CONFIRM
https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
http://www.openwall.com/lists/oss-security/2021/03/27/1	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/03/27/2	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/03/28/3	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/03/28/4	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/202103-03	vendor-advisoryx_refsource_GENTOO
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://www.tenable.com/security/tns-2021-09	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2021032…	x_refsource_CONFIRM
https://security.FreeBSD.org/advisories/FreeBSD-S…	x_refsource_MISC
https://www.tenable.com/security/tns-2021-05	x_refsource_CONFIRM
https://kc.mcafee.com/corporate/index?page=conten…	x_refsource_CONFIRM
https://www.tenable.com/security/tns-2021-08	x_refsource_CONFIRM
https://mta.openssl.org/pipermail/openssl-announc…	x_refsource_MISC
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://kb.pulsesecure.net/articles/Pulse_Securit…	x_refsource_CONFIRM
https://psirt.global.sonicwall.com/vuln-detail/SN…	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)

Date Public

2021-03-25 00:00

Credits

Benjamin Kaduk (Akamai), Xiang Ding (Akamai), others at Akamai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:53:17.644Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20210325.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b"
          },
          {
            "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
          },
          {
            "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
          },
          {
            "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
          },
          {
            "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
          },
          {
            "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
          },
          {
            "name": "GLSA-202103-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202103-03"
          },
          {
            "name": "FEDORA-2021-cbf14ab8f9",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-09"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-05"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-08"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Benjamin Kaduk (Akamai), Xiang Ding (Akamai), others at Akamai"
        }
      ],
      "datePublic": "2021-03-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a \"purpose\" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named \"purpose\" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#High",
              "value": "High"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Invalid Certificate Verification",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:35:11.000Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.openssl.org/news/secadv/20210325.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b"
        },
        {
          "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
        },
        {
          "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
        },
        {
          "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
        },
        {
          "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
        },
        {
          "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
        },
        {
          "name": "GLSA-202103-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202103-03"
        },
        {
          "name": "FEDORA-2021-cbf14ab8f9",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2021-09"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2021-05"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2021-08"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "title": "CA certificate check bypass with X509_V_FLAG_X509_STRICT",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "openssl-security@openssl.org",
          "DATE_PUBLIC": "2021-03-25",
          "ID": "CVE-2021-3450",
          "STATE": "PUBLIC",
          "TITLE": "CA certificate check bypass with X509_V_FLAG_X509_STRICT"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OpenSSL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "OpenSSL"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Benjamin Kaduk (Akamai), Xiang Ding (Akamai), others at Akamai"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a \"purpose\" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named \"purpose\" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)."
            }
          ]
        },
        "impact": [
          {
            "lang": "eng",
            "url": "https://www.openssl.org/policies/secpolicy.html#High",
            "value": "High"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Invalid Certificate Verification"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.openssl.org/news/secadv/20210325.txt",
              "refsource": "CONFIRM",
              "url": "https://www.openssl.org/news/secadv/20210325.txt"
            },
            {
              "name": "https://www.openssl.org/news/secadv/20210325.txt",
              "refsource": "CONFIRM",
              "url": "https://www.openssl.org/news/secadv/20210325.txt"
            },
            {
              "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b",
              "refsource": "CONFIRM",
              "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b"
            },
            {
              "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
            },
            {
              "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
            },
            {
              "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
            },
            {
              "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
            },
            {
              "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
            },
            {
              "name": "GLSA-202103-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202103-03"
            },
            {
              "name": "FEDORA-2021-cbf14ab8f9",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.tenable.com/security/tns-2021-09",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2021-09"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210326-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
            },
            {
              "name": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc",
              "refsource": "MISC",
              "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
            },
            {
              "name": "https://www.tenable.com/security/tns-2021-05",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2021-05"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
            },
            {
              "name": "https://www.tenable.com/security/tns-2021-08",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2021-08"
            },
            {
              "name": "https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html",
              "refsource": "MISC",
              "url": "https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845",
              "refsource": "CONFIRM",
              "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
            },
            {
              "name": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013",
              "refsource": "CONFIRM",
              "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2021-3450",
    "datePublished": "2021-03-25T14:25:14.287Z",
    "dateReserved": "2021-03-19T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:07:10.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3449 (GCVE-0-2021-3449)

Vulnerability from nvd – Published: 2021-03-25 14:25 – Updated: 2024-09-17 03:43

Title

NULL pointer deref in signature_algorithms processing

Summary

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Severity

No CVSS data available.

CWE

NULL pointer dereference

Assigner

openssl

References

29 references

URL	Tags
https://www.openssl.org/news/secadv/20210325.txt
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…
https://tools.cisco.com/security/center/content/C…	vendor-advisory
https://www.debian.org/security/2021/dsa-4875	vendor-advisory
http://www.openwall.com/lists/oss-security/2021/03/27/1	mailing-list
http://www.openwall.com/lists/oss-security/2021/03/27/2	mailing-list
http://www.openwall.com/lists/oss-security/2021/03/28/3	mailing-list
http://www.openwall.com/lists/oss-security/2021/03/28/4	mailing-list
https://security.gentoo.org/glsa/202103-03	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.tenable.com/security/tns-2021-10
https://www.tenable.com/security/tns-2021-09
https://security.netapp.com/advisory/ntap-2021051…
https://security.netapp.com/advisory/ntap-2021032…
https://security.FreeBSD.org/advisories/FreeBSD-S…
https://www.tenable.com/security/tns-2021-06
https://www.tenable.com/security/tns-2021-05
https://kc.mcafee.com/corporate/index?page=conten…
https://www.oracle.com//security-alerts/cpujul2021.html
https://cert-portal.siemens.com/productcert/pdf/s…
https://kb.pulsesecure.net/articles/Pulse_Securit…
https://psirt.global.sonicwall.com/vuln-detail/SN…
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://cert-portal.siemens.com/productcert/pdf/s…
https://www.oracle.com/security-alerts/cpujul2022.html
https://security.netapp.com/advisory/ntap-2024062…

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)

Date Public

2021-03-25 00:00

Credits

Peter Kästle (Nokia) and Samuel Sapalski (Nokia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:53:17.609Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20210325.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148"
          },
          {
            "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
          },
          {
            "name": "DSA-4875",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4875"
          },
          {
            "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
          },
          {
            "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
          },
          {
            "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
          },
          {
            "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
          },
          {
            "name": "GLSA-202103-03",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202103-03"
          },
          {
            "name": "FEDORA-2021-cbf14ab8f9",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-10"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-09"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-06"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
          },
          {
            "name": "[debian-lts-announce] 20210831 [SECURITY] [DLA 2751-1] postgresql-9.6 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Peter K\u00e4stle (Nokia) and Samuel Sapalski (Nokia)"
        }
      ],
      "datePublic": "2021-03-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#High",
              "value": "High"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "NULL pointer dereference",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:05:57.096Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "url": "https://www.openssl.org/news/secadv/20210325.txt"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148"
        },
        {
          "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
        },
        {
          "name": "DSA-4875",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4875"
        },
        {
          "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
        },
        {
          "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
        },
        {
          "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
        },
        {
          "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
        },
        {
          "name": "GLSA-202103-03",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202103-03"
        },
        {
          "name": "FEDORA-2021-cbf14ab8f9",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-10"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-09"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
        },
        {
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-06"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-05"
        },
        {
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
        },
        {
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf"
        },
        {
          "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
        },
        {
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
        },
        {
          "name": "[debian-lts-announce] 20210831 [SECURITY] [DLA 2751-1] postgresql-9.6 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ],
      "title": "NULL pointer deref in signature_algorithms processing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2021-3449",
    "datePublished": "2021-03-25T14:25:13.659Z",
    "dateReserved": "2021-03-17T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:43:55.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-10219 (GCVE-0-2019-10219)

Vulnerability from nvd – Published: 2019-11-08 14:46 – Updated: 2025-07-07 13:55

Summary

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-79

Assigner

redhat

References

19 references

URL	Tags
https://lists.apache.org/thread.html/r87b7e2d2298…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r4f8b4e2541b…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r4f92d7f7682…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2020:0164	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0159	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0160	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0161	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0445	vendor-advisoryx_refsource_REDHAT
https://lists.apache.org/thread.html/rf9c17c3efc4…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rd418deda6f0…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb8dca19a4e5…	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
https://github.com/hibernate/hibernate-validator/…	patch
https://github.com/hibernate/hibernate-validator/…	patch
https://github.com/poc-effectiveness/PoCAdaptatio…	exploit
https://github.com/poc-effectiveness/PoCAdaptatio…	exploit
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2022021…	x_refsource_CONFIRM
https://github.com/hibernate/hibernate-validator/…

Impacted products

1 product

Vendor	Product	Version
Hibernate	hibernate-validator	Affected: 6.0.0.Alpha1 , ≤ 6.0.17.Final (semver) Affected: 6.1.0.Alpha1 , ≤ 6.1.0.Alpha6 (semver) Unaffected: 6.0.18.Final , ≤ 6.0.* (semver) Unaffected: 6.1.0.Final , ≤ * (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-07-02T11:46:38.457Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee"
          },
          {
            "url": "https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe"
          },
          {
            "url": "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219"
          },
          {
            "url": "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit"
          },
          {
            "name": "[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E"
          },
          {
            "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E"
          },
          {
            "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E"
          },
          {
            "name": "RHSA-2020:0164",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0164"
          },
          {
            "name": "RHSA-2020:0159",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0159"
          },
          {
            "name": "RHSA-2020:0160",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0160"
          },
          {
            "name": "RHSA-2020:0161",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0161"
          },
          {
            "name": "RHSA-2020:0445",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0445"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220210-0024/"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://hibernate.org/validator/",
          "defaultStatus": "unknown",
          "product": "hibernate-validator",
          "vendor": "Hibernate",
          "versions": [
            {
              "lessThanOrEqual": "6.0.17.Final",
              "status": "affected",
              "version": "6.0.0.Alpha1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.0.Alpha6",
              "status": "affected",
              "version": "6.1.0.Alpha1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.18.Final",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1.0.Final",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-07T13:55:51.360Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E"
        },
        {
          "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E"
        },
        {
          "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E"
        },
        {
          "name": "RHSA-2020:0164",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0164"
        },
        {
          "name": "RHSA-2020:0159",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0159"
        },
        {
          "name": "RHSA-2020:0160",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0160"
        },
        {
          "name": "RHSA-2020:0161",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0161"
        },
        {
          "name": "RHSA-2020:0445",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0445"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "name": "Upstream fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe"
        },
        {
          "name": "Upstream fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56cee"
        },
        {
          "name": "Proof of Concept",
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219"
        },
        {
          "name": "Proof of Concept",
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220210-0024/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2019-10219",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "hibernate-validator",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Hibernate"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "6.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
              "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
              "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
              "name": "RHSA-2020:0164",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0164"
            },
            {
              "name": "RHSA-2020:0159",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0159"
            },
            {
              "name": "RHSA-2020:0160",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0160"
            },
            {
              "name": "RHSA-2020:0161",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0161"
            },
            {
              "name": "RHSA-2020:0445",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0445"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4@%3Cpluto-scm.portals.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220210-0024/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220210-0024/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2019-10219",
    "datePublished": "2019-11-08T14:46:03.000Z",
    "dateReserved": "2019-03-27T00:00:00.000Z",
    "dateUpdated": "2025-07-07T13:55:51.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1351 (GCVE-0-2015-1351)

Vulnerability from nvd – Published: 2015-03-30 10:00 – Updated: 2024-08-06 04:40

Summary

Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

13 references

URL	Tags
http://www.securityfocus.com/bid/71929	vdb-entryx_refsource_BID
http://openwall.com/lists/oss-security/2015/01/24/9	mailing-listx_refsource_MLIST
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://bugs.php.net/bug.php?id=68677	x_refsource_CONFIRM
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
https://support.apple.com/HT205267	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1053.html	vendor-advisoryx_refsource_REDHAT
https://security.gentoo.org/glsa/201606-10	vendor-advisoryx_refsource_GENTOO
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1066.html	vendor-advisoryx_refsource_REDHAT

Date Public

2015-01-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:40:18.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "71929",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/71929"
          },
          {
            "name": "[oss-security] 20150124 Re: CVE Request: PHP",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2015/01/24/9"
          },
          {
            "name": "APPLE-SA-2015-09-30-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=68677"
          },
          {
            "name": "MDVSA-2015:079",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:079"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/HT205267"
          },
          {
            "name": "RHSA-2015:1053",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
          },
          {
            "name": "GLSA-201606-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201606-10"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=777c39f4042327eac4b63c7ee87dc1c7a09a3115"
          },
          {
            "name": "RHSA-2015:1066",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-01-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-29T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "71929",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/71929"
        },
        {
          "name": "[oss-security] 20150124 Re: CVE Request: PHP",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2015/01/24/9"
        },
        {
          "name": "APPLE-SA-2015-09-30-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.php.net/bug.php?id=68677"
        },
        {
          "name": "MDVSA-2015:079",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:079"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/HT205267"
        },
        {
          "name": "RHSA-2015:1053",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
        },
        {
          "name": "GLSA-201606-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201606-10"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=777c39f4042327eac4b63c7ee87dc1c7a09a3115"
        },
        {
          "name": "RHSA-2015:1066",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-1351",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "71929",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/71929"
            },
            {
              "name": "[oss-security] 20150124 Re: CVE Request: PHP",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2015/01/24/9"
            },
            {
              "name": "APPLE-SA-2015-09-30-3",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
            },
            {
              "name": "https://bugs.php.net/bug.php?id=68677",
              "refsource": "CONFIRM",
              "url": "https://bugs.php.net/bug.php?id=68677"
            },
            {
              "name": "MDVSA-2015:079",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:079"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
            },
            {
              "name": "https://support.apple.com/HT205267",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/HT205267"
            },
            {
              "name": "RHSA-2015:1053",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
            },
            {
              "name": "GLSA-201606-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201606-10"
            },
            {
              "name": "http://git.php.net/?p=php-src.git;a=commit;h=777c39f4042327eac4b63c7ee87dc1c7a09a3115",
              "refsource": "CONFIRM",
              "url": "http://git.php.net/?p=php-src.git;a=commit;h=777c39f4042327eac4b63c7ee87dc1c7a09a3115"
            },
            {
              "name": "RHSA-2015:1066",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-1351",
    "datePublished": "2015-03-30T10:00:00.000Z",
    "dateReserved": "2015-01-24T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:40:18.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2261 (GCVE-0-2011-2261)

Vulnerability from nvd – Published: 2011-07-20 23:00 – Updated: 2024-08-06 22:53

Summary

Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2252.

Severity

No CVSS data available.

CWE

Assigner

oracle

References

2 references

URL	Tags
http://www.us-cert.gov/cas/techalerts/TA11-201A.html	third-party-advisoryx_refsource_CERT
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM

Date Public

2011-07-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:53:17.437Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TA11-201A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2252."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-18T20:57:01.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "TA11-201A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2011-2261",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2252."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "TA11-201A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2011-2261",
    "datePublished": "2011-07-20T23:00:00.000Z",
    "dateReserved": "2011-06-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T22:53:17.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2252 (GCVE-0-2011-2252)

Vulnerability from nvd – Published: 2011-07-20 23:00 – Updated: 2024-08-06 22:53

Summary

Severity

No CVSS data available.

CWE

Assigner

oracle

References

2 references

URL	Tags
http://www.us-cert.gov/cas/techalerts/TA11-201A.html	third-party-advisoryx_refsource_CERT
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM

Date Public

2011-07-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:53:17.306Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TA11-201A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2261."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-18T20:57:01.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "TA11-201A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2011-2252",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2261."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "TA11-201A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2011-2252",
    "datePublished": "2011-07-20T23:00:00.000Z",
    "dateReserved": "2011-06-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T22:53:17.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2251 (GCVE-0-2011-2251)

Vulnerability from nvd – Published: 2011-07-20 23:00 – Updated: 2024-08-06 22:53

Summary

Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect integrity via unknown vectors.

Severity

No CVSS data available.

CWE

Assigner

oracle

References

2 references

URL	Tags
http://www.us-cert.gov/cas/techalerts/TA11-201A.html	third-party-advisoryx_refsource_CERT
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM

Date Public

2011-07-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:53:17.514Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TA11-201A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect integrity via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-10-05T09:00:00.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "TA11-201A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2011-2251",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect integrity via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "TA11-201A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2011-2251",
    "datePublished": "2011-07-20T23:00:00.000Z",
    "dateReserved": "2011-06-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T22:53:17.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-3596 (GCVE-0-2010-3596)

Vulnerability from nvd – Published: 2011-01-19 15:00 – Updated: 2024-08-07 03:18

Summary

Unspecified vulnerability in the mod_ssl component in Oracle Secure Backup 10.3.0.2 allows remote attackers to affect integrity and availability via unknown vectors.

Severity

No CVSS data available.

CWE

Assigner

oracle

References

5 references

URL	Tags
http://www.securityfocus.com/bid/45850	vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1024974	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/42918	third-party-advisoryx_refsource_SECUNIA
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2011/0142	vdb-entryx_refsource_VUPEN

Date Public

2011-01-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:18:51.602Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "45850",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/45850"
          },
          {
            "name": "1024974",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1024974"
          },
          {
            "name": "42918",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42918"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"
          },
          {
            "name": "ADV-2011-0142",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0142"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-01-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the mod_ssl component in Oracle Secure Backup 10.3.0.2 allows remote attackers to affect integrity and availability via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-01-22T10:00:00.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "45850",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/45850"
        },
        {
          "name": "1024974",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1024974"
        },
        {
          "name": "42918",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42918"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"
        },
        {
          "name": "ADV-2011-0142",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0142"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2010-3596",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the mod_ssl component in Oracle Secure Backup 10.3.0.2 allows remote attackers to affect integrity and availability via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "45850",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/45850"
            },
            {
              "name": "1024974",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1024974"
            },
            {
              "name": "42918",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/42918"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"
            },
            {
              "name": "ADV-2011-0142",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0142"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2010-3596",
    "datePublished": "2011-01-19T15:00:00.000Z",
    "dateReserved": "2010-09-20T00:00:00.000Z",
    "dateUpdated": "2024-08-07T03:18:51.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-0907 (GCVE-0-2010-0907)

Vulnerability from nvd – Published: 2010-07-13 22:07 – Updated: 2024-08-07 01:06

Summary

Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0899, CVE-2010-0904, and CVE-2010-0906.

Severity

No CVSS data available.

CWE

Assigner

oracle

References

1 reference

URL	Tags
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM

Date Public

2010-07-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:06:52.364Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0899, CVE-2010-0904, and CVE-2010-0906."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-10-23T09:00:00.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2010-0907",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0899, CVE-2010-0904, and CVE-2010-0906."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2010-0907",
    "datePublished": "2010-07-13T22:07:00.000Z",
    "dateReserved": "2010-03-03T00:00:00.000Z",
    "dateUpdated": "2024-08-07T01:06:52.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-0906 (GCVE-0-2010-0906)

Vulnerability from nvd – Published: 2010-07-13 22:07 – Updated: 2024-08-07 01:06

Summary

Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

Severity

No CVSS data available.

CWE

Assigner

oracle

References

1 reference

URL	Tags
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM

Date Public

2010-07-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:06:52.465Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-10-23T09:00:00.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2010-0906",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2010-0906",
    "datePublished": "2010-07-13T22:07:00.000Z",
    "dateReserved": "2010-03-03T00:00:00.000Z",
    "dateUpdated": "2024-08-07T01:06:52.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-0904 (GCVE-0-2010-0904)

Vulnerability from nvd – Published: 2010-07-13 22:07 – Updated: 2024-08-07 01:06

Summary

Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors.

Severity

No CVSS data available.

CWE

Assigner

oracle

References

3 references

URL	Tags
http://securityreason.com/securityalert/8354	third-party-advisoryx_refsource_SREASON
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://securityreason.com/securityalert/8356	third-party-advisoryx_refsource_SREASON

Date Public

2010-07-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:06:52.483Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "8354",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8354"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
          },
          {
            "name": "8356",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8356"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-09-22T09:00:00.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "8354",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8354"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
        },
        {
          "name": "8356",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8356"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2010-0904",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "8354",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8354"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
            },
            {
              "name": "8356",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8356"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2010-0904",
    "datePublished": "2010-07-13T22:07:00.000Z",
    "dateReserved": "2010-03-03T00:00:00.000Z",
    "dateUpdated": "2024-08-07T01:06:52.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-0899 (GCVE-0-2010-0899)

Vulnerability from nvd – Published: 2010-07-13 22:07 – Updated: 2024-08-07 01:06

Summary

Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0907, and CVE-2010-0906.

Severity

No CVSS data available.

CWE

Assigner

oracle

References

1 reference

URL	Tags
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM

Date Public

2010-07-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:06:52.356Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0907, and CVE-2010-0906."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-10-23T09:00:00.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2010-0899",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0907, and CVE-2010-0906."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2010-0899",
    "datePublished": "2010-07-13T22:07:00.000Z",
    "dateReserved": "2010-03-03T00:00:00.000Z",
    "dateUpdated": "2024-08-07T01:06:52.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-21578 (GCVE-0-2025-21578)

Vulnerability from cvelistv5 – Published: 2025-04-15 20:30 – Updated: 2026-02-26 18:28

Summary

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup.
CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

oracle

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpuapr2025.html	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Oracle Corporation	Oracle Secure Backup	Affected: 12.1.0.1 (semver) Affected: 12.1.0.2 (semver) Affected: 12.1.0.3 (semver) Affected: 18.1.0.0 (semver) Affected: 18.1.0.1 (semver) Affected: 18.1.0.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-21578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T03:55:21.167093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-732",
                "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T18:28:22.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Oracle Secure Backup",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "12.1.0.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.1.0.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.1.0.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "18.1.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "18.1.0.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "18.1.0.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:12.1.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:12.1.0.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:12.1.0.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:18.1.0.0:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:18.1.0.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:secure_backup:18.1.0.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in Oracle Secure Backup (component: General).  Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and  18.1.0.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-15T20:30:54.774Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2025.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2025-21578",
    "datePublished": "2025-04-15T20:30:54.774Z",
    "dateReserved": "2024-12-24T23:18:54.785Z",
    "dateUpdated": "2026-02-26T18:28:22.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-42013 (GCVE-0-2021-42013)

Vulnerability from cvelistv5 – Published: 2021-10-07 15:50 – Updated: 2025-10-21 23:25

CISA KEVIntel

Title

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

Summary

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

apache

References

31 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	x_refsource_MISC
https://lists.apache.org/thread.html/r7c795cd45a3…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb5b0e46f179…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/07/6	mailing-listx_refsource_MLIST
https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
http://jvn.jp/en/jp/JVN51106450/index.html	third-party-advisoryx_refsource_JVN
http://www.openwall.com/lists/oss-security/2021/10/08/1	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r17a4c6ce9af…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/2	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/3	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/4	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/6	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/08/5	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/09/1	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/11/4	mailing-listx_refsource_MLIST
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
http://www.openwall.com/lists/oss-security/2021/10/15/3	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/16/1	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2021102…	x_refsource_CONFIRM
http://packetstormsecurity.com/files/164629/Apach…	x_refsource_MISC
http://packetstormsecurity.com/files/164941/Apach…	x_refsource_MISC
http://packetstormsecurity.com/files/164501/Apach…	x_refsource_MISC
http://packetstormsecurity.com/files/164609/Apach…	x_refsource_MISC
http://packetstormsecurity.com/files/165089/Apach…	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
http://packetstormsecurity.com/files/167397/Apach…	x_refsource_MISC
https://www.povilaika.com/apache-2-4-50-exploit/	x_refsource_MISC
https://security.gentoo.org/glsa/202208-20	vendor-advisoryx_refsource_GENTOO
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: Apache HTTP Server 2.4.49 Affected: Apache HTTP Server 2.4.50

Credits

Reported by Juan Escobar from Dreamlab Technologies, Fernando Muñoz from NULL Life CTF Team, and Shungo Kumasaka

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:22:25.641Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "name": "[announce] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E"
          },
          {
            "name": "[httpd-users] 20211007 [users@httpd] CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/07/6"
          },
          {
            "name": "20211007 Apache HTTP Server Vulnerabilties: October 2021",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"
          },
          {
            "name": "JVN#51106450",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN51106450/index.html"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/1"
          },
          {
            "name": "[httpd-cvs] 20211008 [httpd-site] branch main updated: * Align with CVE-2021-42013 based on the latest findings",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/2"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/3"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/4"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/6"
          },
          {
            "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/08/5"
          },
          {
            "name": "[oss-security] 20211009 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/09/1"
          },
          {
            "name": "[oss-security] 20211011 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/11/4"
          },
          {
            "name": "FEDORA-2021-2a10bc68a4",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"
          },
          {
            "name": "FEDORA-2021-aaf90ef84a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/"
          },
          {
            "name": "[oss-security] 20211015 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/15/3"
          },
          {
            "name": "[oss-security] 20211016 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/16/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211029-0009/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.povilaika.com/apache-2-4-50-exploit/"
          },
          {
            "name": "GLSA-202208-20",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202208-20"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-42013",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T14:28:39.366525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:25:30.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00.000Z",
            "value": "CVE-2021-42013 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "Apache HTTP Server 2.4.49"
            },
            {
              "status": "affected",
              "version": "Apache HTTP Server 2.4.50"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported by Juan Escobar from Dreamlab Technologies, Fernando Mu\u00f1oz from NULL Life CTF Team, and Shungo Kumasaka"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "critical"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-14T01:06:15.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "name": "[announce] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E"
        },
        {
          "name": "[httpd-users] 20211007 [users@httpd] CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/07/6"
        },
        {
          "name": "20211007 Apache HTTP Server Vulnerabilties: October 2021",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"
        },
        {
          "name": "JVN#51106450",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN51106450/index.html"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/1"
        },
        {
          "name": "[httpd-cvs] 20211008 [httpd-site] branch main updated: * Align with CVE-2021-42013 based on the latest findings",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/2"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/3"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/4"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/6"
        },
        {
          "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/08/5"
        },
        {
          "name": "[oss-security] 20211009 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/09/1"
        },
        {
          "name": "[oss-security] 20211011 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/11/4"
        },
        {
          "name": "FEDORA-2021-2a10bc68a4",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"
        },
        {
          "name": "FEDORA-2021-aaf90ef84a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/"
        },
        {
          "name": "[oss-security] 20211015 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/15/3"
        },
        {
          "name": "[oss-security] 20211016 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/16/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211029-0009/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.povilaika.com/apache-2-4-50-exploit/"
        },
        {
          "name": "GLSA-202208-20",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202208-20"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2021-10-06T00:00:00.000Z",
          "value": "reported"
        }
      ],
      "title": "Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-42013",
          "STATE": "PUBLIC",
          "TITLE": "Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "Apache HTTP Server",
                            "version_value": "2.4.49"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "Apache HTTP Server",
                            "version_value": "2.4.50"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Reported by Juan Escobar from Dreamlab Technologies, Fernando Mu\u00f1oz from NULL Life CTF Team, and Shungo Kumasaka"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "critical"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "[announce] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E"
            },
            {
              "name": "[httpd-users] 20211007 [users@httpd] CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20211007 CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/07/6"
            },
            {
              "name": "20211007 Apache HTTP Server Vulnerabilties: October 2021",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"
            },
            {
              "name": "JVN#51106450",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN51106450/index.html"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/1"
            },
            {
              "name": "[httpd-cvs] 20211008 [httpd-site] branch main updated: * Align with CVE-2021-42013 based on the latest findings",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/2"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/3"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/4"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/6"
            },
            {
              "name": "[oss-security] 20211008 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/08/5"
            },
            {
              "name": "[oss-security] 20211009 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/09/1"
            },
            {
              "name": "[oss-security] 20211011 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/11/4"
            },
            {
              "name": "FEDORA-2021-2a10bc68a4",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"
            },
            {
              "name": "FEDORA-2021-aaf90ef84a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/"
            },
            {
              "name": "[oss-security] 20211015 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/15/3"
            },
            {
              "name": "[oss-security] 20211016 Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/16/1"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211029-0009/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211029-0009/"
            },
            {
              "name": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html"
            },
            {
              "name": "https://www.povilaika.com/apache-2-4-50-exploit/",
              "refsource": "MISC",
              "url": "https://www.povilaika.com/apache-2-4-50-exploit/"
            },
            {
              "name": "GLSA-202208-20",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202208-20"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2021-10-06T00:00:00.000Z",
            "value": "reported"
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-42013",
    "datePublished": "2021-10-07T15:50:14.000Z",
    "dateReserved": "2021-10-06T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:25:30.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3712 (GCVE-0-2021-3712)

Vulnerability from cvelistv5 – Published: 2021-08-24 14:50 – Updated: 2026-04-16 14:11

Title

Read buffer overruns processing ASN.1 strings

Summary

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Buffer overflow
CWE-125 - Out-of-bounds Read

Assigner

openssl

References

25 references

URL	Tags
https://www.openssl.org/news/secadv/20210824.txt
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…
https://www.debian.org/security/2021/dsa-4963	vendor-advisory
https://lists.apache.org/thread.html/r18995de860f…	mailing-list
http://www.openwall.com/lists/oss-security/2021/08/26/2	mailing-list
https://lists.apache.org/thread.html/rad5d9f83f0d…	mailing-list
https://security.netapp.com/advisory/ntap-2021082…
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.tenable.com/security/tns-2021-16
https://kc.mcafee.com/corporate/index?page=conten…
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.tenable.com/security/tns-2022-02
https://www.oracle.com/security-alerts/cpuapr2022.html
https://cert-portal.siemens.com/productcert/pdf/s…
https://cert-portal.siemens.com/productcert/pdf/s…
https://security.gentoo.org/glsa/202209-02	vendor-advisory
https://security.gentoo.org/glsa/202210-02	vendor-advisory
https://security.netapp.com/advisory/ntap-2024062…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

210 products

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k) Affected: Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)
Siemens	BFCClient	Affected: 0 , < V2.17 (custom)
Siemens	Industrial Edge - Machine Insight App	Affected: 0 , < * (custom)
Siemens	Industrial Edge - PROFINET IO Connector	Affected: All versions < V1.1.1
Siemens	RUGGEDCOM RM1224 LTE(4G) EU	Affected: All versions < V7.1
Siemens	RUGGEDCOM RM1224 LTE(4G) NAM	Affected: All versions < V7.1
Siemens	RUGGEDCOM ROX MX5000	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX MX5000RE	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1400	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1500	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1501	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1510	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1511	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1512	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1524	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX1536	Affected: 0 , < V2.15.0 (custom)
Siemens	RUGGEDCOM ROX RX5000	Affected: 0 , < V2.15.0 (custom)
Siemens	SCALANCE M804PB	Affected: All versions < V7.1
Siemens	SCALANCE M812-1 ADSL-Router	Affected: All versions < V7.1
Siemens	SCALANCE M816-1 ADSL-Router	Affected: All versions < V7.1
Siemens	SCALANCE M826-2 SHDSL-Router	Affected: All versions < V7.1
Siemens	SCALANCE M874-2	Affected: All versions < V7.1
Siemens	SCALANCE M874-3	Affected: All versions < V7.1
Siemens	SCALANCE M876-3	Affected: All versions < V7.1
Siemens	SCALANCE M876-3 (ROK)	Affected: All versions < V7.1
Siemens	SCALANCE M876-4 (EU)	Affected: All versions < V7.1
Siemens	SCALANCE M876-4 (NAM)	Affected: All versions < V7.1
Siemens	SCALANCE MUM853-1 (EU)	Affected: 0 , < V7.1 (custom)
Siemens	SCALANCE MUM856-1 (EU)	Affected: 0 , < V7.1 (custom)
Siemens	SCALANCE MUM856-1 (RoW)	Affected: 0 , < V7.1 (custom)
Siemens	SCALANCE S615 LAN-Router	Affected: All versions < V7.1
Siemens	SCALANCE SC622-2C	Affected: All versions < V2.3
Siemens	SCALANCE SC632-2C	Affected: All versions < V2.3
Siemens	SCALANCE SC636-2C	Affected: All versions < V2.3
Siemens	SCALANCE SC642-2C	Affected: All versions < V2.3
Siemens	SCALANCE SC646-2C	Affected: All versions < V2.3
Siemens	SCALANCE W1748-1 M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W1788-1 M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W1788-2 EEC M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W1788-2 M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W1788-2IA M12	Affected: 0 , < V3.0.0 (custom)
Siemens	SCALANCE W721-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W722-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W734-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W734-1 RJ45 (USA)	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W738-1 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W748-1 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W748-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W761-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W774-1 M12 EEC	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W774-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W774-1 RJ45 (USA)	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W778-1 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W778-1 M12 EEC	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W778-1 M12 EEC (USA)	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W786-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W786-2 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W786-2 SFP	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W786-2IA RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-1 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-1 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-2 M12	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-2 M12 EEC	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE W788-2 RJ45	Affected: 0 , < V6.6.0 (custom)
Siemens	SCALANCE WAM766-1	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WAM766-1 (US)	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WAM766-1 EEC	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WAM766-1 EEC (US)	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WUM766-1	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE WUM766-1 (USA)	Affected: 0 , < V1.2.0 (custom)
Siemens	SCALANCE X200-4P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X201-3P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X201-3P IRT PRO	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X202-2IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X202-2P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X202-2P IRT PRO	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X204-2	Affected: All versions < V5.2.6
Siemens	SCALANCE X204-2FM	Affected: All versions < V5.2.6
Siemens	SCALANCE X204-2LD	Affected: All versions < V5.2.6
Siemens	SCALANCE X204-2LD TS	Affected: All versions < V5.2.6
Siemens	SCALANCE X204-2TS	Affected: All versions < V5.2.6
Siemens	SCALANCE X204IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X204IRT PRO	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE X206-1	Affected: All versions < V5.2.6
Siemens	SCALANCE X206-1LD	Affected: All versions < V5.2.6
Siemens	SCALANCE X208	Affected: All versions < V5.2.6
Siemens	SCALANCE X208PRO	Affected: All versions < V5.2.6
Siemens	SCALANCE X212-2	Affected: All versions < V5.2.6
Siemens	SCALANCE X212-2LD	Affected: All versions < V5.2.6
Siemens	SCALANCE X216	Affected: All versions < V5.2.6
Siemens	SCALANCE X224	Affected: All versions < V5.2.6
Siemens	SCALANCE X302-7 EEC (230V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (230V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (24V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (2x 230V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (2x 230V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (2x 24V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X302-7 EEC (2x 24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X304-2FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X306-1LD FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (230V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (230V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (24V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (2x 230V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (2x 230V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (2x 24V, coated)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-2 EEC (2x 24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-3	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X307-3LD	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2LD	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2LH	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2LH+	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2M	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2M PoE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X308-2M TS	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X310	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X310FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X320-1 FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X320-1-2LD FE	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE X408-2	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XF201-3P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE XF202-2P IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE XF204	Affected: All versions < V5.2.6
Siemens	SCALANCE XF204-2	Affected: All versions < V5.2.6
Siemens	SCALANCE XF204-2BA IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE XF204IRT	Affected: 0 , < V5.5.2 (custom)
Siemens	SCALANCE XF206-1	Affected: All versions < V5.2.6
Siemens	SCALANCE XF208	Affected: All versions < V5.2.6
Siemens	SCALANCE XR324-12M (230V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-12M (230V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-12M (24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-12M (24V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-12M TS (24V)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (24V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (2x 24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M EEC (2x 24V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE (230V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE (230V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE (24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE (24V, ports on rear)	Affected: 0 , < V4.1.4 (custom)
Siemens	SCALANCE XR324-4M PoE TS (24V, ports on front)	Affected: 0 , < V4.1.4 (custom)
Siemens	SIMATIC CP 1242-7 V2	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1243-1	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1243-7 LTE EU	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1243-7 LTE US	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1243-8 IRC	Affected: All versions < V3.3.46
Siemens	SIMATIC CP 1542SP-1	Affected: 0 , < V2.2.28 (custom)
Siemens	SIMATIC CP 1543-1	Affected: All versions < V3.0.22
Siemens	SIMATIC CP 1543SP-1	Affected: 0 , < V2.2.28 (custom)
Siemens	SIMATIC CP 1545-1	Affected: All versions < V1.1
Siemens	SIMATIC PCS neo (Administration Console)	Affected: 0 , < V3.1.1 (custom)
Siemens	SIMATIC Process Historian OPC UA Server	Affected: 0 , < V2020 SP1 (custom)
Siemens	SIMATIC S7-1200 CPU 1211C AC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1211C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1211C DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212C AC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212C DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1212FC DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214C AC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214C DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1214FC DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215C AC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215C DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1215FC DC/DC/Rly	Affected: 0 , < V4.5.2 (custom)
Siemens	SIMATIC S7-1200 CPU 1217C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SINEC NMS	Affected: 0 , < V1.0 SP3 (custom)
Siemens	SINEMA Remote Connect Server	Affected: 0 , < V3.1 (custom)
Siemens	SINEMA Server V14	Affected: 0 , < * (custom)
Siemens	SINUMERIK Operate	Affected: All versions < V4.95 SP1
Siemens	SIPLUS ET 200SP CP 1543SP-1 ISEC	Affected: 0 , < V2.2.28 (custom)
Siemens	SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL	Affected: 0 , < V2.2.28 (custom)
Siemens	SIPLUS NET CP 1242-7 V2	Affected: All versions < V3.3.46
Siemens	SIPLUS NET CP 1543-1	Affected: All versions < V3.0.22
Siemens	SIPLUS NET SCALANCE X308-2	Affected: 0 , < V4.1.4 (custom)
Siemens	SIPLUS S7-1200 CP 1243-1	Affected: All versions < V3.3.46
Siemens	SIPLUS S7-1200 CP 1243-1 RAIL	Affected: All versions < V3.3.46
Siemens	SIPLUS S7-1200 CPU 1212 AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1212 DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1212C AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214 AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214 DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214C AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1214FC DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215 AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215C AC/DC/RLY	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215C DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	SIPLUS S7-1200 CPU 1215FC DC/DC/DC	Affected: 0 , < V4.5.2 (custom)
Siemens	TIA Administrator	Affected: 0 , < V1.0.7 (custom)

Date Public

2021-08-24 00:00

Credits

Ingo Schwarze

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:08.180Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20210824.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12"
          },
          {
            "name": "DSA-4963",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4963"
          },
          {
            "name": "[tomcat-dev] 20210825 OpenSSL security announcement - do we need a Tomcat Native release?",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210825 OpenSSL SM2 Decryption Buffer Overflow (CVE-2021-3711), Read buffer overruns processing ASN.1 strings (CVE-2021-3712)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/08/26/2"
          },
          {
            "name": "[tomcat-dev] 20210826 Re: OpenSSL security announcement - do we need a Tomcat Native release?",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210827-0010/"
          },
          {
            "name": "[debian-lts-announce] 20210926 [SECURITY] [DLA 2766-1] openssl security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html"
          },
          {
            "name": "[debian-lts-announce] 20210930 [SECURITY] [DLA 2774-1] openssl1.0 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2022-02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf"
          },
          {
            "name": "GLSA-202209-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-02"
          },
          {
            "name": "GLSA-202210-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "BFCClient",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge - Machine Insight App",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge - PROFINET IO Connector",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V1.1.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RM1224 LTE(4G) EU",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RM1224 LTE(4G) NAM",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000RE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1400",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1500",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1501",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1510",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1511",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1512",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1524",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1536",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.15.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M804PB",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M812-1 ADSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M812-1 ADSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M816-1 ADSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M816-1 ADSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M826-2 SHDSL-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M874-2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M874-3",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M876-3",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M876-3 (ROK)",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M876-4 (EU)",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE M876-4 (NAM)",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE MUM853-1 (EU)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V7.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE MUM856-1 (EU)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V7.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE MUM856-1 (RoW)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V7.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE S615 LAN-Router",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V7.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC622-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC632-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC636-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC642-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE SC646-2C",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V2.3"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1788-2 EEC M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W1788-2IA M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W721-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W721-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W721-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W721-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W722-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W734-1 RJ45 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W738-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W738-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W738-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W738-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W748-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W761-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W761-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W761-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W761-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W774-1 RJ45 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12 EEC (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W778-1 M12 EEC (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 SFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 SFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 SFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2 SFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2IA RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2IA RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2IA RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W786-2IA RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-1 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 M12 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE W788-2 RJ45",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V6.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WAM766-1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WAM766-1 (US)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WAM766-1 EEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WAM766-1 EEC (US)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WUM766-1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE WUM766-1 (USA)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X200-4P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X201-3P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X201-3P IRT PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X202-2IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X202-2P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X202-2P IRT PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2FM",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2LD",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2LD TS",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204-2TS",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X204IRT PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X206-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X206-1LD",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X208",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X208PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X212-2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X212-2LD",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X216",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X224",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (230V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (230V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (24V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (2x 230V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (2x 230V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (2x 24V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X302-7 EEC (2x 24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X304-2FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X306-1LD FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (230V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (230V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (24V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (2x 230V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (2x 230V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (2x 24V, coated)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-2 EEC (2x 24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-3",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-3",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-3LD",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X307-3LD",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LD",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LD",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LH",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LH",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LH+",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2LH+",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M PoE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M PoE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M TS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X308-2M TS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X310",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X310",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X310FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X310FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X320-1 FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X320-1-2LD FE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE X408-2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF201-3P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF202-2P IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF204",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF204-2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF204-2BA IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF204IRT",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF206-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XF208",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V5.2.6"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (230V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (230V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (230V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (230V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M TS (24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-12M TS (24V)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M EEC (2x 24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE (230V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE (230V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE (24V, ports on rear)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XR324-4M PoE TS (24V, ports on front)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1242-7 V2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1243-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1243-7 LTE EU",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1243-7 LTE US",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1243-8 IRC",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1542SP-1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1543-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.0.22"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1543SP-1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CP 1545-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V1.1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC PCS neo (Administration Console)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC Process Historian OPC UA Server",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2020 SP1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1211C AC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1211C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1211C DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212C AC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212C DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1212FC DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214C AC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214C DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1214FC DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215C AC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215C DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1215FC DC/DC/Rly",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1200 CPU 1217C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SINEC NMS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.0 SP3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SINEMA Remote Connect Server",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SINEMA Server V14",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SINUMERIK Operate",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c  V4.95 SP1"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS ET 200SP CP 1543SP-1 ISEC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS NET CP 1242-7 V2",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS NET CP 1543-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.0.22"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS NET SCALANCE X308-2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.1.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CP 1243-1",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CP 1243-1 RAIL",
            "vendor": "Siemens",
            "versions": [
              {
                "status": "affected",
                "version": "All versions \u003c V3.3.46"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212 AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212C AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214 AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214C DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1214FC DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215 DC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215C AC/DC/RLY",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215C DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1200 CPU 1215FC DC/DC/DC",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.5.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "TIA Administrator",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.0.7",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-14T08:57:51.339Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-244969.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-389290.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-028723.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019200.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-3712",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T14:11:09.557845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T14:11:16.454Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k)"
            },
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ingo Schwarze"
        }
      ],
      "datePublic": "2021-08-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL\u0027s own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#Moderate",
              "value": "Moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Buffer overflow",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:21.902Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "url": "https://www.openssl.org/news/secadv/20210824.txt"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12"
        },
        {
          "name": "DSA-4963",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4963"
        },
        {
          "name": "[tomcat-dev] 20210825 OpenSSL security announcement - do we need a Tomcat Native release?",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210825 OpenSSL SM2 Decryption Buffer Overflow (CVE-2021-3711), Read buffer overruns processing ASN.1 strings (CVE-2021-3712)",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/08/26/2"
        },
        {
          "name": "[tomcat-dev] 20210826 Re: OpenSSL security announcement - do we need a Tomcat Native release?",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210827-0010/"
        },
        {
          "name": "[debian-lts-announce] 20210926 [SECURITY] [DLA 2766-1] openssl security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html"
        },
        {
          "name": "[debian-lts-announce] 20210930 [SECURITY] [DLA 2774-1] openssl1.0 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-16"
        },
        {
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "url": "https://www.tenable.com/security/tns-2022-02"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf"
        },
        {
          "name": "GLSA-202209-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-02"
        },
        {
          "name": "GLSA-202210-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-02"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ],
      "title": "Read buffer overruns processing ASN.1 strings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2021-3712",
    "datePublished": "2021-08-24T14:50:14.704Z",
    "dateReserved": "2021-08-16T00:00:00.000Z",
    "dateUpdated": "2026-04-16T14:11:16.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-33193 (GCVE-0-2021-33193)

Vulnerability from cvelistv5 – Published: 2021-08-16 00:00 – Updated: 2024-08-03 23:42

Title

Request splitting via HTTP/2 method injection and mod_proxy

Summary

Severity

No CVSS data available.

CWE

Request Splitting

Assigner

apache

References

13 references

URL	Tags
https://portswigger.net/research/http2
https://github.com/apache/httpd/commit/ecebcc035c…
https://lists.apache.org/thread.html/re4162adc051…	mailing-list
https://lists.apache.org/thread.html/ree7519d7141…	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://tools.cisco.com/security/center/content/C…	vendor-advisory
https://www.oracle.com/security-alerts/cpujan2022.html
https://security.netapp.com/advisory/ntap-2021091…
https://www.tenable.com/security/tns-2021-17
https://www.oracle.com/security-alerts/cpuapr2022.html
https://security.gentoo.org/glsa/202208-20	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: Apache HTTP Server 2.4 2.4.17 to 2.4.48

Credits

Reported by James Kettle of PortSwigger

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:42:20.253Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://portswigger.net/research/http2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch"
          },
          {
            "name": "[httpd-cvs] 20210916 [httpd-site] branch main updated: Revert \"Add descriptions for CVE-2021-33193 CVE-2021-36160\"",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210916 [httpd-site] branch main updated: Add descriptions for CVE-2021-33193 CVE-2021-36160",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "FEDORA-2021-5d2d4b6ac5",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/"
          },
          {
            "name": "FEDORA-2021-f94985afca",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/"
          },
          {
            "name": "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210917-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "name": "GLSA-202208-20",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202208-20"
          },
          {
            "name": "[debian-lts-announce] 20230303 [SECURITY] [DLA 3351-1] apache2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "Apache HTTP Server 2.4 2.4.17 to 2.4.48"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported by James Kettle of PortSwigger"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Request Splitting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-03T00:00:00.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "url": "https://portswigger.net/research/http2"
        },
        {
          "url": "https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch"
        },
        {
          "name": "[httpd-cvs] 20210916 [httpd-site] branch main updated: Revert \"Add descriptions for CVE-2021-33193 CVE-2021-36160\"",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-cvs] 20210916 [httpd-site] branch main updated: Add descriptions for CVE-2021-33193 CVE-2021-36160",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "FEDORA-2021-5d2d4b6ac5",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/"
        },
        {
          "name": "FEDORA-2021-f94985afca",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/"
        },
        {
          "name": "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210917-0004/"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-17"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "name": "GLSA-202208-20",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202208-20"
        },
        {
          "name": "[debian-lts-announce] 20230303 [SECURITY] [DLA 3351-1] apache2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00002.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2021-05-11T00:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2021-08-06T00:00:00.000Z",
          "value": "public"
        }
      ],
      "title": "Request splitting via HTTP/2 method injection and mod_proxy",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-33193",
    "datePublished": "2021-08-16T00:00:00.000Z",
    "dateReserved": "2021-05-19T00:00:00.000Z",
    "dateUpdated": "2024-08-03T23:42:20.253Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26691 (GCVE-0-2021-26691)

Vulnerability from cvelistv5 – Published: 2021-06-10 07:10 – Updated: 2024-08-03 20:33

Title

Apache HTTP Server mod_session response handling heap overflow

Summary

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

Severity

No CVSS data available.

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

apache

References

13 references

URL	Tags
http://httpd.apache.org/security/vulnerabilities_…	x_refsource_MISC
https://lists.apache.org/thread.html/re026d3da9d7…	x_refsource_MISC
https://lists.apache.org/thread.html/r50cae1b71f1…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r7f2b70b6216…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/06/10/7	mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2021/dsa-4937	vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/202107-38	vendor-advisoryx_refsource_GENTOO
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2021070…	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.46 Affected: 2.4.43 Affected: 2.4.41 Affected: 2.4.39 Affected: 2.4.38 Affected: 2.4.37 Affected: 2.4.35 Affected: 2.4.34 Affected: 2.4.33 Affected: 2.4.29 Affected: 2.4.28 Affected: 2.4.27 Affected: 2.4.26 Affected: 2.4.25 Affected: 2.4.23 Affected: 2.4.20 Affected: 2.4.18 Affected: 2.4.17 Affected: 2.4.16 Affected: 2.4.12 Affected: 2.4.10 Affected: 2.4.9 Affected: 2.4.7 Affected: 2.4.6 Affected: 2.4.4 Affected: 2.4.3 Affected: 2.4.2 Affected: 2.4.1 Affected: 2.4.0

Credits

Discovered internally Christophe Jaillet

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:33:40.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/06/10/7"
          },
          {
            "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
          },
          {
            "name": "DSA-4937",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4937"
          },
          {
            "name": "GLSA-202107-38",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-38"
          },
          {
            "name": "FEDORA-2021-dce7e7738e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
          },
          {
            "name": "FEDORA-2021-e3f6dd670d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.46"
            },
            {
              "status": "affected",
              "version": "2.4.43"
            },
            {
              "status": "affected",
              "version": "2.4.41"
            },
            {
              "status": "affected",
              "version": "2.4.39"
            },
            {
              "status": "affected",
              "version": "2.4.38"
            },
            {
              "status": "affected",
              "version": "2.4.37"
            },
            {
              "status": "affected",
              "version": "2.4.35"
            },
            {
              "status": "affected",
              "version": "2.4.34"
            },
            {
              "status": "affected",
              "version": "2.4.33"
            },
            {
              "status": "affected",
              "version": "2.4.29"
            },
            {
              "status": "affected",
              "version": "2.4.28"
            },
            {
              "status": "affected",
              "version": "2.4.27"
            },
            {
              "status": "affected",
              "version": "2.4.26"
            },
            {
              "status": "affected",
              "version": "2.4.25"
            },
            {
              "status": "affected",
              "version": "2.4.23"
            },
            {
              "status": "affected",
              "version": "2.4.20"
            },
            {
              "status": "affected",
              "version": "2.4.18"
            },
            {
              "status": "affected",
              "version": "2.4.17"
            },
            {
              "status": "affected",
              "version": "2.4.16"
            },
            {
              "status": "affected",
              "version": "2.4.12"
            },
            {
              "status": "affected",
              "version": "2.4.10"
            },
            {
              "status": "affected",
              "version": "2.4.9"
            },
            {
              "status": "affected",
              "version": "2.4.7"
            },
            {
              "status": "affected",
              "version": "2.4.6"
            },
            {
              "status": "affected",
              "version": "2.4.4"
            },
            {
              "status": "affected",
              "version": "2.4.3"
            },
            {
              "status": "affected",
              "version": "2.4.2"
            },
            {
              "status": "affected",
              "version": "2.4.1"
            },
            {
              "status": "affected",
              "version": "2.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Discovered internally Christophe Jaillet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "low"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-07T14:41:53.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/06/10/7"
        },
        {
          "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
        },
        {
          "name": "DSA-4937",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4937"
        },
        {
          "name": "GLSA-202107-38",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-38"
        },
        {
          "name": "FEDORA-2021-dce7e7738e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
        },
        {
          "name": "FEDORA-2021-e3f6dd670d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache HTTP Server mod_session response handling heap overflow",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-26691",
          "STATE": "PUBLIC",
          "TITLE": "Apache HTTP Server mod_session response handling heap overflow"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.46"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.43"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.41"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.39"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.38"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.37"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.35"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.34"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.33"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.29"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.28"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.27"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.26"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.25"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.23"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.20"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.18"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.17"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.16"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.12"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.10"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.9"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.7"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.6"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.4"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.3"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.2"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.1"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Discovered internally Christophe Jaillet"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "low"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-122 Heap-based Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe@%3Cannounce.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/06/10/7"
            },
            {
              "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
            },
            {
              "name": "DSA-4937",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4937"
            },
            {
              "name": "GLSA-202107-38",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-38"
            },
            {
              "name": "FEDORA-2021-dce7e7738e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
            },
            {
              "name": "FEDORA-2021-e3f6dd670d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210702-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-26691",
    "datePublished": "2021-06-10T07:10:23.000Z",
    "dateReserved": "2021-02-04T00:00:00.000Z",
    "dateUpdated": "2024-08-03T20:33:40.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3450 (GCVE-0-2021-3450)

Vulnerability from cvelistv5 – Published: 2021-03-25 14:25 – Updated: 2024-09-17 03:07

Title

CA certificate check bypass with X509_V_FLAG_X509_STRICT

Summary

Severity

No CVSS data available.

CWE

Invalid Certificate Verification

Assigner

openssl

References

24 references

URL	Tags
https://www.openssl.org/news/secadv/20210325.txt	x_refsource_CONFIRM
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…	x_refsource_CONFIRM
https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
http://www.openwall.com/lists/oss-security/2021/03/27/1	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/03/27/2	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/03/28/3	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/03/28/4	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/202103-03	vendor-advisoryx_refsource_GENTOO
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://www.tenable.com/security/tns-2021-09	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2021032…	x_refsource_CONFIRM
https://security.FreeBSD.org/advisories/FreeBSD-S…	x_refsource_MISC
https://www.tenable.com/security/tns-2021-05	x_refsource_CONFIRM
https://kc.mcafee.com/corporate/index?page=conten…	x_refsource_CONFIRM
https://www.tenable.com/security/tns-2021-08	x_refsource_CONFIRM
https://mta.openssl.org/pipermail/openssl-announc…	x_refsource_MISC
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://kb.pulsesecure.net/articles/Pulse_Securit…	x_refsource_CONFIRM
https://psirt.global.sonicwall.com/vuln-detail/SN…	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)

Date Public

2021-03-25 00:00

Credits

Benjamin Kaduk (Akamai), Xiang Ding (Akamai), others at Akamai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:53:17.644Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20210325.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b"
          },
          {
            "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
          },
          {
            "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
          },
          {
            "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
          },
          {
            "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
          },
          {
            "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
          },
          {
            "name": "GLSA-202103-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202103-03"
          },
          {
            "name": "FEDORA-2021-cbf14ab8f9",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-09"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-05"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-08"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Benjamin Kaduk (Akamai), Xiang Ding (Akamai), others at Akamai"
        }
      ],
      "datePublic": "2021-03-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a \"purpose\" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named \"purpose\" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#High",
              "value": "High"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Invalid Certificate Verification",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:35:11.000Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.openssl.org/news/secadv/20210325.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b"
        },
        {
          "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
        },
        {
          "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
        },
        {
          "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
        },
        {
          "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
        },
        {
          "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
        },
        {
          "name": "GLSA-202103-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202103-03"
        },
        {
          "name": "FEDORA-2021-cbf14ab8f9",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2021-09"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2021-05"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2021-08"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "title": "CA certificate check bypass with X509_V_FLAG_X509_STRICT",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "openssl-security@openssl.org",
          "DATE_PUBLIC": "2021-03-25",
          "ID": "CVE-2021-3450",
          "STATE": "PUBLIC",
          "TITLE": "CA certificate check bypass with X509_V_FLAG_X509_STRICT"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OpenSSL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "OpenSSL"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Benjamin Kaduk (Akamai), Xiang Ding (Akamai), others at Akamai"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a \"purpose\" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named \"purpose\" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j)."
            }
          ]
        },
        "impact": [
          {
            "lang": "eng",
            "url": "https://www.openssl.org/policies/secpolicy.html#High",
            "value": "High"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Invalid Certificate Verification"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.openssl.org/news/secadv/20210325.txt",
              "refsource": "CONFIRM",
              "url": "https://www.openssl.org/news/secadv/20210325.txt"
            },
            {
              "name": "https://www.openssl.org/news/secadv/20210325.txt",
              "refsource": "CONFIRM",
              "url": "https://www.openssl.org/news/secadv/20210325.txt"
            },
            {
              "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b",
              "refsource": "CONFIRM",
              "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b"
            },
            {
              "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
            },
            {
              "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
            },
            {
              "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
            },
            {
              "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
            },
            {
              "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
            },
            {
              "name": "GLSA-202103-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202103-03"
            },
            {
              "name": "FEDORA-2021-cbf14ab8f9",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.tenable.com/security/tns-2021-09",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2021-09"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210326-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
            },
            {
              "name": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc",
              "refsource": "MISC",
              "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
            },
            {
              "name": "https://www.tenable.com/security/tns-2021-05",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2021-05"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
            },
            {
              "name": "https://www.tenable.com/security/tns-2021-08",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2021-08"
            },
            {
              "name": "https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html",
              "refsource": "MISC",
              "url": "https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845",
              "refsource": "CONFIRM",
              "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
            },
            {
              "name": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013",
              "refsource": "CONFIRM",
              "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2021-3450",
    "datePublished": "2021-03-25T14:25:14.287Z",
    "dateReserved": "2021-03-19T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:07:10.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3449 (GCVE-0-2021-3449)

Vulnerability from cvelistv5 – Published: 2021-03-25 14:25 – Updated: 2024-09-17 03:43

Title

NULL pointer deref in signature_algorithms processing

Summary

Severity

No CVSS data available.

CWE

NULL pointer dereference

Assigner

openssl

References

29 references

URL	Tags
https://www.openssl.org/news/secadv/20210325.txt
https://git.openssl.org/gitweb/?p=openssl.git%3Ba…
https://tools.cisco.com/security/center/content/C…	vendor-advisory
https://www.debian.org/security/2021/dsa-4875	vendor-advisory
http://www.openwall.com/lists/oss-security/2021/03/27/1	mailing-list
http://www.openwall.com/lists/oss-security/2021/03/27/2	mailing-list
http://www.openwall.com/lists/oss-security/2021/03/28/3	mailing-list
http://www.openwall.com/lists/oss-security/2021/03/28/4	mailing-list
https://security.gentoo.org/glsa/202103-03	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.tenable.com/security/tns-2021-10
https://www.tenable.com/security/tns-2021-09
https://security.netapp.com/advisory/ntap-2021051…
https://security.netapp.com/advisory/ntap-2021032…
https://security.FreeBSD.org/advisories/FreeBSD-S…
https://www.tenable.com/security/tns-2021-06
https://www.tenable.com/security/tns-2021-05
https://kc.mcafee.com/corporate/index?page=conten…
https://www.oracle.com//security-alerts/cpujul2021.html
https://cert-portal.siemens.com/productcert/pdf/s…
https://kb.pulsesecure.net/articles/Pulse_Securit…
https://psirt.global.sonicwall.com/vuln-detail/SN…
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://cert-portal.siemens.com/productcert/pdf/s…
https://www.oracle.com/security-alerts/cpujul2022.html
https://security.netapp.com/advisory/ntap-2024062…

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)

Date Public

2021-03-25 00:00

Credits

Peter Kästle (Nokia) and Samuel Sapalski (Nokia)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:53:17.609Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20210325.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148"
          },
          {
            "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
          },
          {
            "name": "DSA-4875",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4875"
          },
          {
            "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
          },
          {
            "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
          },
          {
            "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
          },
          {
            "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
          },
          {
            "name": "GLSA-202103-03",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202103-03"
          },
          {
            "name": "FEDORA-2021-cbf14ab8f9",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-10"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-09"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-06"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
          },
          {
            "name": "[debian-lts-announce] 20210831 [SECURITY] [DLA 2751-1] postgresql-9.6 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Peter K\u00e4stle (Nokia) and Samuel Sapalski (Nokia)"
        }
      ],
      "datePublic": "2021-03-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#High",
              "value": "High"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "NULL pointer dereference",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:05:57.096Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "url": "https://www.openssl.org/news/secadv/20210325.txt"
        },
        {
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148"
        },
        {
          "name": "20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd"
        },
        {
          "name": "DSA-4875",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4875"
        },
        {
          "name": "[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/27/1"
        },
        {
          "name": "[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/27/2"
        },
        {
          "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/28/3"
        },
        {
          "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4"
        },
        {
          "name": "GLSA-202103-03",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202103-03"
        },
        {
          "name": "FEDORA-2021-cbf14ab8f9",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-10"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-09"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210326-0006/"
        },
        {
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-06"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-05"
        },
        {
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356"
        },
        {
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf"
        },
        {
          "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845"
        },
        {
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013"
        },
        {
          "name": "[debian-lts-announce] 20210831 [SECURITY] [DLA 2751-1] postgresql-9.6 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ],
      "title": "NULL pointer deref in signature_algorithms processing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2021-3449",
    "datePublished": "2021-03-25T14:25:13.659Z",
    "dateReserved": "2021-03-17T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:43:55.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-10219 (GCVE-0-2019-10219)

Vulnerability from cvelistv5 – Published: 2019-11-08 14:46 – Updated: 2025-07-07 13:55

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-79

Assigner

redhat

References

19 references

URL	Tags
https://lists.apache.org/thread.html/r87b7e2d2298…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r4f8b4e2541b…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r4f92d7f7682…	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2020:0164	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0159	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0160	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0161	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0445	vendor-advisoryx_refsource_REDHAT
https://lists.apache.org/thread.html/rf9c17c3efc4…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rd418deda6f0…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb8dca19a4e5…	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
https://github.com/hibernate/hibernate-validator/…	patch
https://github.com/hibernate/hibernate-validator/…	patch
https://github.com/poc-effectiveness/PoCAdaptatio…	exploit
https://github.com/poc-effectiveness/PoCAdaptatio…	exploit
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2022021…	x_refsource_CONFIRM
https://github.com/hibernate/hibernate-validator/…

Impacted products

1 product

Vendor	Product	Version
Hibernate	hibernate-validator	Affected: 6.0.0.Alpha1 , ≤ 6.0.17.Final (semver) Affected: 6.1.0.Alpha1 , ≤ 6.1.0.Alpha6 (semver) Unaffected: 6.0.18.Final , ≤ 6.0.* (semver) Unaffected: 6.1.0.Final , ≤ * (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-07-02T11:46:38.457Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56ceee"
          },
          {
            "url": "https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe"
          },
          {
            "url": "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219"
          },
          {
            "url": "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit"
          },
          {
            "name": "[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E"
          },
          {
            "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E"
          },
          {
            "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E"
          },
          {
            "name": "RHSA-2020:0164",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0164"
          },
          {
            "name": "RHSA-2020:0159",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0159"
          },
          {
            "name": "RHSA-2020:0160",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0160"
          },
          {
            "name": "RHSA-2020:0161",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0161"
          },
          {
            "name": "RHSA-2020:0445",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0445"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E"
          },
          {
            "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220210-0024/"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://hibernate.org/validator/",
          "defaultStatus": "unknown",
          "product": "hibernate-validator",
          "vendor": "Hibernate",
          "versions": [
            {
              "lessThanOrEqual": "6.0.17.Final",
              "status": "affected",
              "version": "6.0.0.Alpha1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.0.Alpha6",
              "status": "affected",
              "version": "6.1.0.Alpha1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.18.Final",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1.0.Final",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-07T13:55:51.360Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E"
        },
        {
          "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E"
        },
        {
          "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E"
        },
        {
          "name": "RHSA-2020:0164",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0164"
        },
        {
          "name": "RHSA-2020:0159",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0159"
        },
        {
          "name": "RHSA-2020:0160",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0160"
        },
        {
          "name": "RHSA-2020:0161",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0161"
        },
        {
          "name": "RHSA-2020:0445",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0445"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E"
        },
        {
          "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "name": "Upstream fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe"
        },
        {
          "name": "Upstream fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56cee"
        },
        {
          "name": "Proof of Concept",
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219"
        },
        {
          "name": "Proof of Concept",
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220210-0024/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2019-10219",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "hibernate-validator",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Hibernate"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "6.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
              "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
              "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
              "name": "RHSA-2020:0164",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0164"
            },
            {
              "name": "RHSA-2020:0159",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0159"
            },
            {
              "name": "RHSA-2020:0160",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0160"
            },
            {
              "name": "RHSA-2020:0161",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0161"
            },
            {
              "name": "RHSA-2020:0445",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0445"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
              "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4@%3Cpluto-scm.portals.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220210-0024/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220210-0024/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2019-10219",
    "datePublished": "2019-11-08T14:46:03.000Z",
    "dateReserved": "2019-03-27T00:00:00.000Z",
    "dateUpdated": "2025-07-07T13:55:51.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1351 (GCVE-0-2015-1351)

Vulnerability from cvelistv5 – Published: 2015-03-30 10:00 – Updated: 2024-08-06 04:40

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre

References

13 references

URL	Tags
http://www.securityfocus.com/bid/71929	vdb-entryx_refsource_BID
http://openwall.com/lists/oss-security/2015/01/24/9	mailing-listx_refsource_MLIST
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://bugs.php.net/bug.php?id=68677	x_refsource_CONFIRM
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
https://support.apple.com/HT205267	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1053.html	vendor-advisoryx_refsource_REDHAT
https://security.gentoo.org/glsa/201606-10	vendor-advisoryx_refsource_GENTOO
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1066.html	vendor-advisoryx_refsource_REDHAT

Date Public

2015-01-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:40:18.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "71929",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/71929"
          },
          {
            "name": "[oss-security] 20150124 Re: CVE Request: PHP",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2015/01/24/9"
          },
          {
            "name": "APPLE-SA-2015-09-30-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=68677"
          },
          {
            "name": "MDVSA-2015:079",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:079"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/HT205267"
          },
          {
            "name": "RHSA-2015:1053",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
          },
          {
            "name": "GLSA-201606-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201606-10"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=777c39f4042327eac4b63c7ee87dc1c7a09a3115"
          },
          {
            "name": "RHSA-2015:1066",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-01-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-29T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "71929",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/71929"
        },
        {
          "name": "[oss-security] 20150124 Re: CVE Request: PHP",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2015/01/24/9"
        },
        {
          "name": "APPLE-SA-2015-09-30-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.php.net/bug.php?id=68677"
        },
        {
          "name": "MDVSA-2015:079",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:079"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/HT205267"
        },
        {
          "name": "RHSA-2015:1053",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
        },
        {
          "name": "GLSA-201606-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201606-10"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=777c39f4042327eac4b63c7ee87dc1c7a09a3115"
        },
        {
          "name": "RHSA-2015:1066",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-1351",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "71929",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/71929"
            },
            {
              "name": "[oss-security] 20150124 Re: CVE Request: PHP",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2015/01/24/9"
            },
            {
              "name": "APPLE-SA-2015-09-30-3",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
            },
            {
              "name": "https://bugs.php.net/bug.php?id=68677",
              "refsource": "CONFIRM",
              "url": "https://bugs.php.net/bug.php?id=68677"
            },
            {
              "name": "MDVSA-2015:079",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:079"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
            },
            {
              "name": "https://support.apple.com/HT205267",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/HT205267"
            },
            {
              "name": "RHSA-2015:1053",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
            },
            {
              "name": "GLSA-201606-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201606-10"
            },
            {
              "name": "http://git.php.net/?p=php-src.git;a=commit;h=777c39f4042327eac4b63c7ee87dc1c7a09a3115",
              "refsource": "CONFIRM",
              "url": "http://git.php.net/?p=php-src.git;a=commit;h=777c39f4042327eac4b63c7ee87dc1c7a09a3115"
            },
            {
              "name": "RHSA-2015:1066",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-1351",
    "datePublished": "2015-03-30T10:00:00.000Z",
    "dateReserved": "2015-01-24T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:40:18.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2261 (GCVE-0-2011-2261)

Vulnerability from cvelistv5 – Published: 2011-07-20 23:00 – Updated: 2024-08-06 22:53

Summary

Severity

No CVSS data available.

CWE

Assigner

oracle

References

2 references

URL	Tags
http://www.us-cert.gov/cas/techalerts/TA11-201A.html	third-party-advisoryx_refsource_CERT
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM

Date Public

2011-07-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:53:17.437Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TA11-201A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2252."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-18T20:57:01.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "TA11-201A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2011-2261",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2252."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "TA11-201A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2011-2261",
    "datePublished": "2011-07-20T23:00:00.000Z",
    "dateReserved": "2011-06-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T22:53:17.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2251 (GCVE-0-2011-2251)

Vulnerability from cvelistv5 – Published: 2011-07-20 23:00 – Updated: 2024-08-06 22:53

Summary

Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect integrity via unknown vectors.

Severity

No CVSS data available.

CWE

Assigner

oracle

References

2 references

URL	Tags
http://www.us-cert.gov/cas/techalerts/TA11-201A.html	third-party-advisoryx_refsource_CERT
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM

Date Public

2011-07-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:53:17.514Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TA11-201A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect integrity via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-10-05T09:00:00.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "TA11-201A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2011-2251",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect integrity via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "TA11-201A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2011-2251",
    "datePublished": "2011-07-20T23:00:00.000Z",
    "dateReserved": "2011-06-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T22:53:17.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-2252 (GCVE-0-2011-2252)

Vulnerability from cvelistv5 – Published: 2011-07-20 23:00 – Updated: 2024-08-06 22:53

Summary

Severity

No CVSS data available.

CWE

Assigner

oracle

References

2 references

URL	Tags
http://www.us-cert.gov/cas/techalerts/TA11-201A.html	third-party-advisoryx_refsource_CERT
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM

Date Public

2011-07-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:53:17.306Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TA11-201A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-07-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2261."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-18T20:57:01.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "TA11-201A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2011-2252",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2011-2261."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "TA11-201A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-201A.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2011-2252",
    "datePublished": "2011-07-20T23:00:00.000Z",
    "dateReserved": "2011-06-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T22:53:17.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-3596 (GCVE-0-2010-3596)

Vulnerability from cvelistv5 – Published: 2011-01-19 15:00 – Updated: 2024-08-07 03:18

Summary

Unspecified vulnerability in the mod_ssl component in Oracle Secure Backup 10.3.0.2 allows remote attackers to affect integrity and availability via unknown vectors.

Severity

No CVSS data available.

CWE

Assigner

oracle

References

5 references

URL	Tags
http://www.securityfocus.com/bid/45850	vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1024974	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/42918	third-party-advisoryx_refsource_SECUNIA
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2011/0142	vdb-entryx_refsource_VUPEN

Date Public

2011-01-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:18:51.602Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "45850",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/45850"
          },
          {
            "name": "1024974",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1024974"
          },
          {
            "name": "42918",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42918"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"
          },
          {
            "name": "ADV-2011-0142",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0142"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-01-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the mod_ssl component in Oracle Secure Backup 10.3.0.2 allows remote attackers to affect integrity and availability via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-01-22T10:00:00.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "45850",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/45850"
        },
        {
          "name": "1024974",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1024974"
        },
        {
          "name": "42918",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42918"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"
        },
        {
          "name": "ADV-2011-0142",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0142"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2010-3596",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the mod_ssl component in Oracle Secure Backup 10.3.0.2 allows remote attackers to affect integrity and availability via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "45850",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/45850"
            },
            {
              "name": "1024974",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1024974"
            },
            {
              "name": "42918",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/42918"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html"
            },
            {
              "name": "ADV-2011-0142",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0142"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2010-3596",
    "datePublished": "2011-01-19T15:00:00.000Z",
    "dateReserved": "2010-09-20T00:00:00.000Z",
    "dateUpdated": "2024-08-07T03:18:51.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}