{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Provize Basic versions ant\u00e9rieures \u00e0 1.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Belden",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-37701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701"
    },
    {
      "name": "CVE-2021-23406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23406"
    },
    {
      "name": "CVE-2021-32804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-32804"
    },
    {
      "name": "CVE-2021-33623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33623"
    },
    {
      "name": "CVE-2021-37713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37713"
    },
    {
      "name": "CVE-2021-37712",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712"
    },
    {
      "name": "CVE-2021-32803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-32803"
    },
    {
      "name": "CVE-2021-23214",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23214"
    },
    {
      "name": "CVE-2020-28469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28469"
    },
    {
      "name": "CVE-2021-3749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3749"
    }
  ],
  "initial_release_date": "2022-05-05T00:00:00",
  "last_revision_date": "2022-05-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-413",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-05-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Belden Provize\nBasic. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une\natteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Belden Provize Basic",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Belden BSECV-2022-01 du 03 mai 2022",
      "url": "https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=14297\u0026mediaformatid=50063\u0026destinationid=10016"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Belden BSECV-2022-11 du 03 mai 2022",
      "url": "https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=14299\u0026mediaformatid=50063\u0026destinationid=10016"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Belden BSECV-2022-05 du 03 mai 2022",
      "url": "https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=14298\u0026mediaformatid=50063\u0026destinationid=10016"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Cognos Analytics versions 11.1.x ant\u00e9rieures \u00e0 11.1.7 Fix Pack 5",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Cognos Analytics versions 11.2.x ant\u00e9rieures \u00e0 11.2.3",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-4301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4301"
    },
    {
      "name": "CVE-2021-20468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-20468"
    },
    {
      "name": "CVE-2021-29823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29823"
    },
    {
      "name": "CVE-2021-44532",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532"
    },
    {
      "name": "CVE-2022-36773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36773"
    },
    {
      "name": "CVE-2021-3807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3807"
    },
    {
      "name": "CVE-2022-29078",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-29078"
    },
    {
      "name": "CVE-2021-23438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23438"
    },
    {
      "name": "CVE-2021-43797",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43797"
    },
    {
      "name": "CVE-2022-30614",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-30614"
    },
    {
      "name": "CVE-2021-44533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533"
    },
    {
      "name": "CVE-2021-29418",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29418"
    },
    {
      "name": "CVE-2020-36518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-36518"
    },
    {
      "name": "CVE-2021-39045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39045"
    },
    {
      "name": "CVE-2022-21824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824"
    },
    {
      "name": "CVE-2022-21803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21803"
    },
    {
      "name": "CVE-2021-39009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39009"
    },
    {
      "name": "CVE-2021-44531",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531"
    },
    {
      "name": "CVE-2021-28918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28918"
    },
    {
      "name": "CVE-2020-28469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28469"
    },
    {
      "name": "CVE-2021-3749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3749"
    }
  ],
  "initial_release_date": "2022-09-01T00:00:00",
  "last_revision_date": "2022-09-01T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-785",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-09-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans IBM Cognos\nAnalytics. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Cognos Analytics",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6615285 du 31 ao\u00fbt 2022",
      "url": "https://www.ibm.com/support/pages/node/6615285"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "RUGGEDCOM ROS RSG920P versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Parasolid V33.1 versions 33.1.x ant\u00e9rieures \u00e0 33.1.263",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSG2300 versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Parasolid V33.1 versions 34.0.x ant\u00e9rieures \u00e0 34.0.252",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RS416v2 versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSG908C versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSG2288 versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RST2228P versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RST916C versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RS900 (32M) versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Mendix SAML Module versions 3.3.x ant\u00e9rieures \u00e0 3.3.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RS900G (32M) versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEC INS versions ant\u00e9rieures \u00e0 1.0 SP2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CoreShield One-Way Gateway (OWG) Software versions ant\u00e9rieures \u00e0 2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RMC8388 versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSG2100 (32M) versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Mendix SAML Module versions 2.3.x ant\u00e9rieures \u00e0 2.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Simcenter Femap V2022.2 versions ant\u00e9rieures \u00e0 V2022.2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSG2300P versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RS416Pv2 versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RST916P versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Simcenter Femap V2022.1 versions ant\u00e9rieures \u00e0 V2022.1.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSG909R versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSG907R versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RST2228 versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSG2488 versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Mendix SAML Module versions 1.17.x ant\u00e9rieures \u00e0 1.17.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSL910 versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROS RSG910C versions ant\u00e9rieures \u00e0 5.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Parasolid V35.0 versions 35.0.x ant\u00e9rieures \u00e0 35.0.164",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Parasolid V33.1 versions 34.1.x ant\u00e9rieures \u00e0 34.1.242",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2016-0701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0701"
    },
    {
      "name": "CVE-2021-25220",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-25220"
    },
    {
      "name": "CVE-2022-39144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39144"
    },
    {
      "name": "CVE-2022-39145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39145"
    },
    {
      "name": "CVE-2022-39137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39137"
    },
    {
      "name": "CVE-2022-39155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39155"
    },
    {
      "name": "CVE-2022-39146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39146"
    },
    {
      "name": "CVE-2022-39152",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39152"
    },
    {
      "name": "CVE-2020-28168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28168"
    },
    {
      "name": "CVE-2021-23337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23337"
    },
    {
      "name": "CVE-2022-0155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0155"
    },
    {
      "name": "CVE-2021-4160",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-4160"
    },
    {
      "name": "CVE-2022-39143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39143"
    },
    {
      "name": "CVE-2022-39140",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39140"
    },
    {
      "name": "CVE-2022-39158",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39158"
    },
    {
      "name": "CVE-2022-39153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39153"
    },
    {
      "name": "CVE-2022-39156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39156"
    },
    {
      "name": "CVE-2020-7793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7793"
    },
    {
      "name": "CVE-2021-23839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23839"
    },
    {
      "name": "CVE-2022-38466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38466"
    },
    {
      "name": "CVE-2022-39154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39154"
    },
    {
      "name": "CVE-2020-28500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28500"
    },
    {
      "name": "CVE-2022-39147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39147"
    },
    {
      "name": "CVE-2022-37011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37011"
    },
    {
      "name": "CVE-2022-0235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0235"
    },
    {
      "name": "CVE-2022-39138",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39138"
    },
    {
      "name": "CVE-2022-39141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39141"
    },
    {
      "name": "CVE-2022-39139",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39139"
    },
    {
      "name": "CVE-2020-12762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-12762"
    },
    {
      "name": "CVE-2022-39148",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39148"
    },
    {
      "name": "CVE-2021-23841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23841"
    },
    {
      "name": "CVE-2022-39142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39142"
    },
    {
      "name": "CVE-2022-39149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39149"
    },
    {
      "name": "CVE-2022-39151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39151"
    },
    {
      "name": "CVE-2021-25217",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-25217"
    },
    {
      "name": "CVE-2022-0396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0396"
    },
    {
      "name": "CVE-2021-3749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3749"
    },
    {
      "name": "CVE-2022-39150",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39150"
    }
  ],
  "initial_release_date": "2022-09-13T00:00:00",
  "last_revision_date": "2022-09-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-814",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-09-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSIEMENS. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SIEMENS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-589975 du 13 septembre 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-589975.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-638652 du 13 septembre 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-638652.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-459643 du 13 septembre 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-459643.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-518824 du 13 septembre 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-518824.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-637483 du 13 septembre 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-637483.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QRadar SIEM versions 7.5.0 sans les derniers correctifs de s\u00e9curit\u00e9 pour les protocoles GoogleCloudPubSub, GoogleCommon et GoogleGSuiteActivityReportsRESTAPI",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar SIEM versions 7.5.0 ant\u00e9rieures \u00e0 7.5.0 UP12 IF03",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Remote Server sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct versions 6.4.x ant\u00e9rieures \u00e0 6.4.0.2 pour Unix",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct FTP+ versions 1.3.0 ant\u00e9rieures \u00e0 1.3.0.1",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 Query Management Facility versions 13.1 et 12.2.0.5 sans le JRE 8.0.8.45",
      "product": {
        "name": "Db2 Query Management Facility",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct versions 6.3.x ant\u00e9rieures \u00e0 6.3.0.5 pour Unix",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics versions 11.2.x ant\u00e9rieures \u00e0 11.2.3",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct versions 6.2.x ant\u00e9rieures \u00e0 6.2.0.7 pour Windows",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar Incident Forensics versions 7.5.0 ant\u00e9rieures \u00e0 7.5.0 UP12 IF03",
      "product": {
        "name": "QRadar Incident Forensics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server Liberty versions ant\u00e9rieures \u00e0 25.0.0.8",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct versions 6.2.x ant\u00e9rieures \u00e0 6.2.0.7.iFix052 pour Unix",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics versions 11.1.x ant\u00e9rieures \u00e0 11.1.7 Fix Pack 5",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server versions 9.0.0.x ant\u00e9rieures \u00e0 9.0.5.25",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere eXtreme Scale versions 8.6.1.x ant\u00e9rieures \u00e0 8.6.1.6 sans le correctif PH67142 iFix",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-4447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4447"
    },
    {
      "name": "CVE-2020-4301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4301"
    },
    {
      "name": "CVE-2024-52005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-52005"
    },
    {
      "name": "CVE-2021-20468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-20468"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2025-49125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125"
    },
    {
      "name": "CVE-2021-29823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29823"
    },
    {
      "name": "CVE-2021-44532",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532"
    },
    {
      "name": "CVE-2025-36097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36097"
    },
    {
      "name": "CVE-2022-36773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36773"
    },
    {
      "name": "CVE-2021-3807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3807"
    },
    {
      "name": "CVE-2025-48976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
    },
    {
      "name": "CVE-2025-21587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-21587"
    },
    {
      "name": "CVE-2022-29078",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-29078"
    },
    {
      "name": "CVE-2023-33953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33953"
    },
    {
      "name": "CVE-2021-23438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23438"
    },
    {
      "name": "CVE-2021-43797",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43797"
    },
    {
      "name": "CVE-2023-32732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32732"
    },
    {
      "name": "CVE-2025-48988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988"
    },
    {
      "name": "CVE-2022-30614",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-30614"
    },
    {
      "name": "CVE-2025-30698",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30698"
    },
    {
      "name": "CVE-2022-49395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49395"
    },
    {
      "name": "CVE-2021-44533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533"
    },
    {
      "name": "CVE-2025-22869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22869"
    },
    {
      "name": "CVE-2021-29418",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29418"
    },
    {
      "name": "CVE-2020-36518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-36518"
    },
    {
      "name": "CVE-2021-39045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39045"
    },
    {
      "name": "CVE-2022-21824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824"
    },
    {
      "name": "CVE-2022-21803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21803"
    },
    {
      "name": "CVE-2021-39009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39009"
    },
    {
      "name": "CVE-2025-32414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-32414"
    },
    {
      "name": "CVE-2020-16156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16156"
    },
    {
      "name": "CVE-2025-2900",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2900"
    },
    {
      "name": "CVE-2025-5283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5283"
    },
    {
      "name": "CVE-2021-44531",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531"
    },
    {
      "name": "CVE-2021-28918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28918"
    },
    {
      "name": "CVE-2025-36038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36038"
    },
    {
      "name": "CVE-2020-28469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28469"
    },
    {
      "name": "CVE-2021-3749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3749"
    },
    {
      "name": "CVE-2025-48734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48734"
    }
  ],
  "initial_release_date": "2025-07-18T00:00:00",
  "last_revision_date": "2025-07-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0608",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-07-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2025-07-14",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239645",
      "url": "https://www.ibm.com/support/pages/node/7239645"
    },
    {
      "published_at": "2025-07-14",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239617",
      "url": "https://www.ibm.com/support/pages/node/7239617"
    },
    {
      "published_at": "2025-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239753",
      "url": "https://www.ibm.com/support/pages/node/7239753"
    },
    {
      "published_at": "2025-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239757",
      "url": "https://www.ibm.com/support/pages/node/7239757"
    },
    {
      "published_at": "2025-07-16",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239856",
      "url": "https://www.ibm.com/support/pages/node/7239856"
    },
    {
      "published_at": "2025-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239492",
      "url": "https://www.ibm.com/support/pages/node/7239492"
    },
    {
      "published_at": "2025-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6615285",
      "url": "https://www.ibm.com/support/pages/node/6615285"
    },
    {
      "published_at": "2025-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239816",
      "url": "https://www.ibm.com/support/pages/node/7239816"
    },
    {
      "published_at": "2025-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239564",
      "url": "https://www.ibm.com/support/pages/node/7239564"
    },
    {
      "published_at": "2025-07-14",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239627",
      "url": "https://www.ibm.com/support/pages/node/7239627"
    },
    {
      "published_at": "2025-07-14",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239598",
      "url": "https://www.ibm.com/support/pages/node/7239598"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "A12CFACF-6FBD-4AE9-A7BF-9D532DAA8212",
              "versionEndIncluding": "0.21.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C89891C1-DFD7-4E1F-80A9-7485D86A15B5",
              "versionEndExcluding": "1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "4664B195-AF14-4834-82B3-0B2C98020EB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "75BC588E-CDF0-404E-AD61-02093A1DF343",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B359C56A-5507-4CC0-975A-683A9DBBE3FC",
              "versionEndExcluding": "21.7.0.0.0",
              "versionStartIncluding": "21.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "axios is vulnerable to Inefficient Regular Expression Complexity"
    },
    {
      "lang": "es",
      "value": "axios es vulnerable a una Complejidad de Expresi\u00f3n Regular Ineficiente"
    }
  ],
  "id": "CVE-2021-3749",
  "lastModified": "2024-11-21T06:22:19.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.8,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-08-31T11:15:07.890",
  "references": [
    {
      "source": "security@huntr.dev",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a%40%3Cdev.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "url": "https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a%40%3Cdev.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103%40%3Ccommits.druid.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "axios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.21.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-3749"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-01T18:14:02Z",
    "nvd_published_at": "2021-08-31T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.",
  "id": "GHSA-cph5-m8f7-6c5x",
  "modified": "2022-09-14T21:28:32Z",
  "published": "2021-09-01T18:23:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3749"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/axios"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103@%3Ccommits.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a@%3Cdev.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289@%3Ccommits.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1@%3Ccommits.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321@%3Ccommits.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1@%3Ccommits.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391@%3Ccommits.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8@%3Ccommits.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2@%3Ccommits.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10@%3Ccommits.druid.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/axios/axios"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "axios Inefficient Regular Expression Complexity vulnerability"
}

{
  "GSD": {
    "alias": "CVE-2021-3749",
    "description": "axios is vulnerable to Inefficient Regular Expression Complexity",
    "id": "GSD-2021-3749",
    "references": [
      "https://access.redhat.com/errata/RHSA-2021:4902",
      "https://access.redhat.com/errata/RHSA-2021:4618",
      "https://access.redhat.com/errata/RHSA-2021:3694",
      "https://access.redhat.com/errata/RHSA-2022:0056",
      "https://access.redhat.com/errata/RHSA-2022:1276"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-3749"
      ],
      "details": "axios is vulnerable to Inefficient Regular Expression Complexity",
      "id": "GSD-2021-3749",
      "modified": "2023-12-13T01:23:35.074534Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@huntr.dev",
        "ID": "CVE-2021-3749",
        "STATE": "PUBLIC",
        "TITLE": "Inefficient Regular Expression Complexity in axios/axios"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "axios/axios",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_value": "0.21.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "axios"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "axios is vulnerable to Inefficient Regular Expression Complexity"
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.0"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-1333 Inefficient Regular Expression Complexity"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31",
            "refsource": "CONFIRM",
            "url": "https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31"
          },
          {
            "name": "https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929",
            "refsource": "MISC",
            "url": "https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929"
          },
          {
            "name": "[druid-commits] 20211008 [GitHub] [druid] andreacyc closed pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1@%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20211008 [GitHub] [druid] andreacyc opened a new pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103@%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20211008 [GitHub] [druid] jihoonson commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2@%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20211009 [GitHub] [druid] jihoonson closed pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8@%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20211009 [GitHub] [druid] andreacyc opened a new pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1@%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20211009 [druid] branch master updated: Fix CVE-2021-3749 reported in security vulnerabilities job (#11786)",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321@%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20211009 [GitHub] [druid] jihoonson commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289@%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20211009 [GitHub] [druid] jihoonson merged pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391@%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-commits] 20211009 [GitHub] [druid] andreacyc commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10@%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "[druid-dev] 20211009 [CRON] Passed: apache/druid#33528 (master - adb2237)",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a@%3Cdev.druid.apache.org%3E"
          },
          {
            "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
            "refsource": "MISC",
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf",
            "refsource": "CONFIRM",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"
          }
        ]
      },
      "source": {
        "advisory": "1e8f07fc-c384-4ff9-8498-0690de2e8c31",
        "discovery": "EXTERNAL"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=0.21.1",
          "affected_versions": "All versions up to 0.21.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-1333",
            "CWE-937"
          ],
          "date": "2022-10-07",
          "description": "axios is vulnerable to Inefficient Regular Expression Complexity",
          "fixed_versions": [
            "0.21.2"
          ],
          "identifier": "CVE-2021-3749",
          "identifiers": [
            "CVE-2021-3749"
          ],
          "not_impacted": "All versions after 0.21.1",
          "package_slug": "npm/axios",
          "pubdate": "2021-08-31",
          "solution": "Upgrade to version 0.21.2 or above.",
          "title": "Incorrect Comparison",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-3749"
          ],
          "uuid": "152e684f-4871-4d8f-8c91-dba369813d80"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.21.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "21.7.0.0.0",
                "versionStartIncluding": "21.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3749"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "axios is vulnerable to Inefficient Regular Expression Complexity"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-1333"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929"
            },
            {
              "name": "https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31"
            },
            {
              "name": "[druid-commits] 20211008 [GitHub] [druid] andreacyc opened a new pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20211008 [GitHub] [druid] andreacyc closed pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20211008 [GitHub] [druid] jihoonson commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20211009 [GitHub] [druid] jihoonson closed pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20211009 [GitHub] [druid] andreacyc opened a new pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20211009 [GitHub] [druid] jihoonson commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20211009 [druid] branch master updated: Fix CVE-2021-3749 reported in security vulnerabilities job (#11786)",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20211009 [GitHub] [druid] jihoonson merged pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-commits] 20211009 [GitHub] [druid] andreacyc commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "[druid-dev] 20211009 [CRON] Passed: apache/druid#33528 (master - adb2237)",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a@%3Cdev.druid.apache.org%3E"
            },
            {
              "name": "N/A",
              "refsource": "N/A",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-10-07T02:19Z",
      "publishedDate": "2021-08-31T11:15Z"
    }
  }
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities affecting various third-party components of\nSINEC INS before V1.0 SP2 could allow an attacker to cause a denial of\nservice condition, disclose sensitive data or violate the system\nintegrity.    Siemens has released an update for the SINEC INS and\nrecommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect\nnetwork access to devices with appropriate mechanisms. In order to\noperate the devices in a protected IT environment, Siemens recommends\nto configure the environment according to Siemens\u0027 operational\nguidelines for Industrial Security (Download:\nhttps://www.siemens.com/cert/operational-guidelines-industrial-\nsecurity), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found\nat: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-637483.json"
      },
      {
        "category": "self",
        "summary": "SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-637483.txt"
      },
      {
        "category": "self",
        "summary": "SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-258-05 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-258-05.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-258-05 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-258-05"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SINEC INS",
    "tracking": {
      "current_release_date": "2022-09-13T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-258-05",
      "initial_release_date": "2022-09-13T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-09-13T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV1.0_SP2",
                "product": {
                  "name": "SINEC INS",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEC INS"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-7793",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-7793"
    },
    {
      "cve": "CVE-2020-12762",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-12762"
    },
    {
      "cve": "CVE-2020-28168",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-28168"
    },
    {
      "cve": "CVE-2020-28500",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-28500"
    },
    {
      "cve": "CVE-2021-3749",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "summary",
          "text": "axios is vulnerable to Inefficient Regular Expression Complexity",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2021-3749"
    },
    {
      "cve": "CVE-2021-4160",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2021-4160"
    },
    {
      "cve": "CVE-2021-23337",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2021-23337"
    },
    {
      "cve": "CVE-2021-23839",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is supposed to reject connection attempts from a client where this special form of padding is present, because this indicates that a version rollback has occurred (i.e. both client and server support greater than SSLv2, and yet this is the version that is being requested). The implementation of this padding check inverted the logic so that the connection attempt is accepted if the padding is present, and rejected if it is absent. This means that such as server will accept a connection if a version rollback attack has occurred. Further the server will erroneously reject a connection if a normal SSLv2 connection attempt is made. Only OpenSSL 1.0.2 servers from version 1.0.2s to 1.0.2x are affected by this issue. In order to be vulnerable a 1.0.2 server must: 1) have configured SSLv2 support at compile time (this is off by default), 2) have configured SSLv2 support at runtime (this is off by default), 3) have configured SSLv2 ciphersuites (these are not in the default ciphersuite list) OpenSSL 1.1.1 does not have SSLv2 support and therefore is not vulnerable to this issue. The underlying error is in the implementation of the RSA_padding_check_SSLv23() function. This also affects the RSA_SSLV23_PADDING padding mode used by various other functions. Although 1.1.1 does not support SSLv2 the RSA_padding_check_SSLv23() function still exists, as does the RSA_SSLV23_PADDING padding mode. Applications that directly call that function or use that padding mode will encounter this issue. However since there is no support for the SSLv2 protocol in 1.1.1 this is considered a bug and not a security issue in that version. OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.0.2y (Affected 1.0.2s-1.0.2x).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2021-23839"
    },
    {
      "cve": "CVE-2021-23841",
      "cwe": {
        "id": "CWE-311",
        "name": "Missing Encryption of Sensitive Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2021-23841"
    },
    {
      "cve": "CVE-2021-25217",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected products contain the third party component, ISC DHCP, that possesses a vulnerability if used as a DHCP client or server. The vulnerability affects the DHCP package when storing and reading DHCP lease information containing particular option information.\r\n\r\nAn attacker could exploit this vulnerability to affect the availability of the DHCP client or server, or in the worst case affect the confidentiality or integrity of device through a buffer overflow or cause a remote-code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2021-25217"
    },
    {
      "cve": "CVE-2021-25220",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "BIND 9.11.0 -\u003e 9.11.36 9.12.0 -\u003e 9.16.26 9.17.0 -\u003e 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -\u003e 9.11.36-S1 9.16.8-S1 -\u003e 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2021-25220"
    },
    {
      "cve": "CVE-2022-0155",
      "cwe": {
        "id": "CWE-359",
        "name": "Exposure of Private Personal Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "summary",
          "text": "follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-0155"
    },
    {
      "cve": "CVE-2022-0235",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-0235"
    },
    {
      "cve": "CVE-2022-0396",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "summary",
          "text": "BIND 9.16.11 -\u003e 9.16.26, 9.17.0 -\u003e 9.18.0 and versions 9.16.11-S1 -\u003e 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP2 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812610/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-0396"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Subnet Solutions Inc",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could result in an attacker bypassing a proxy, creating a denial-of-service condition, or viewing sensitive information.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing, Energy",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Canada",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolating them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Do not click web links or open attachments in unsolicited email messages.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-277-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-277-02.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-24-277-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Subnet Solutions Inc. PowerSYSTEM Center",
    "tracking": {
      "current_release_date": "2024-10-01T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-24-277-02",
      "initial_release_date": "2024-10-01T06:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-10-01T06:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=PSC_2020_v5.21.x",
                "product": {
                  "name": "Subnet Solutions Inc. PowerSYSTEM Center: \u003c=PSC_2020_v5.21.x",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "PowerSYSTEM Center"
          }
        ],
        "category": "vendor",
        "name": "Subnet Solutions Inc."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-28168",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vulnerable versions of PowerSYSTEM Center utilize Axios NPM package 0.21.0, which contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-28168"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Subnet Solutions Inc. recommends users update to PowerSYSTEM Center 2020 Update 22, which can be located in the PowerSYSTEM Center by accessing Settings \u003e Overview \u003e Version. Users may also contact Subnet Solution\u0027s Customer Service",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://subnet.com/contact/"
        },
        {
          "category": "mitigation",
          "details": "Subnet Solutions Inc. strongly recommends users update to the latest version. If this is not possible, the following paragraphs describe the security control compensation(s), mitigation(s), or workaround(s) available for identified vulnerabilities:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For all vulnerabilities, users can disable usage of previous UI extensions.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For CVE-2020-28168 and CVE-2023-45857, users can limit outbound connection requests from the PowerSYSTEM Center security zone to external websites.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-3749",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vulnerable versions of PowerSYSTEM Center utilize Axios, which is vulnerable to Inefficient Regular Expression Complexity.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3749"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Subnet Solutions Inc. recommends users update to PowerSYSTEM Center 2020 Update 22, which can be located in the PowerSYSTEM Center by accessing Settings \u003e Overview \u003e Version. Users may also contact Subnet Solution\u0027s Customer Service",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://subnet.com/contact/"
        },
        {
          "category": "mitigation",
          "details": "Subnet Solutions Inc. strongly recommends users update to the latest version. If this is not possible, the following paragraphs describe the security control compensation(s), mitigation(s), or workaround(s) available for identified vulnerabilities:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For all vulnerabilities, users can disable usage of previous UI extensions.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For CVE-2023-45857 and CVE-2021-3749, users can disable PowerSYSTEM Center Client Access Server user\u0027s ability to access the browser\u0027s F12 Developer Tools to limit user ability to see HTTP headers and corresponding XSRF-TOKEN, and to manipulate requests to the PowerSYSTEM Center website.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-45857",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vulnerable versions of PowerSYSTEM Center utilize Axios 1.5.1, which can inadvertently reveal the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-45857"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Subnet Solutions Inc. recommends users update to PowerSYSTEM Center 2020 Update 22, which can be located in the PowerSYSTEM Center by accessing Settings \u003e Overview \u003e Version. Users may also contact Subnet Solution\u0027s Customer Service",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://subnet.com/contact/"
        },
        {
          "category": "mitigation",
          "details": "Subnet Solutions Inc. strongly recommends users update to the latest version. If this is not possible, the following paragraphs describe the security control compensation(s), mitigation(s), or workaround(s) available for identified vulnerabilities:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For all vulnerabilities, users can disable usage of previous UI extensions.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For CVE-2020-28168 and CVE-2023-45857, users can limit outbound connection requests from the PowerSYSTEM Center security zone to external websites.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "For CVE-2023-45857 and CVE-2021-3749, users can disable PowerSYSTEM Center Client Access Server user\u0027s ability to access the browser\u0027s F12 Developer Tools to limit user ability to see HTTP headers and corresponding XSRF-TOKEN, and to manipulate requests to the PowerSYSTEM Center website.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated release packages fix several bugs and add various enhancements.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Migration Toolkit for Virtualization (MTV) 2.2.0",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHEA-2021:5066",
        "url": "https://access.redhat.com/errata/RHEA-2021:5066"
      },
      {
        "category": "external",
        "summary": "1919636",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1919636"
      },
      {
        "category": "external",
        "summary": "1944402",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1944402"
      },
      {
        "category": "external",
        "summary": "1951660",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1951660"
      },
      {
        "category": "external",
        "summary": "1953253",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1953253"
      },
      {
        "category": "external",
        "summary": "1953989",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1953989"
      },
      {
        "category": "external",
        "summary": "1957841",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957841"
      },
      {
        "category": "external",
        "summary": "1959229",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1959229"
      },
      {
        "category": "external",
        "summary": "1959377",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1959377"
      },
      {
        "category": "external",
        "summary": "1965030",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1965030"
      },
      {
        "category": "external",
        "summary": "1965328",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1965328"
      },
      {
        "category": "external",
        "summary": "1977260",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1977260"
      },
      {
        "category": "external",
        "summary": "1981074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981074"
      },
      {
        "category": "external",
        "summary": "1990596",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1990596"
      },
      {
        "category": "external",
        "summary": "1990851",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1990851"
      },
      {
        "category": "external",
        "summary": "1993089",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1993089"
      },
      {
        "category": "external",
        "summary": "1993140",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1993140"
      },
      {
        "category": "external",
        "summary": "1993259",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1993259"
      },
      {
        "category": "external",
        "summary": "1994037",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1994037"
      },
      {
        "category": "external",
        "summary": "1994042",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1994042"
      },
      {
        "category": "external",
        "summary": "1994093",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1994093"
      },
      {
        "category": "external",
        "summary": "1994146",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1994146"
      },
      {
        "category": "external",
        "summary": "1994467",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1994467"
      },
      {
        "category": "external",
        "summary": "1994479",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1994479"
      },
      {
        "category": "external",
        "summary": "1994978",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1994978"
      },
      {
        "category": "external",
        "summary": "1995075",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1995075"
      },
      {
        "category": "external",
        "summary": "1995197",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1995197"
      },
      {
        "category": "external",
        "summary": "1996360",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1996360"
      },
      {
        "category": "external",
        "summary": "1996587",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1996587"
      },
      {
        "category": "external",
        "summary": "1999163",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999163"
      },
      {
        "category": "external",
        "summary": "2011354",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011354"
      },
      {
        "category": "external",
        "summary": "2011785",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011785"
      },
      {
        "category": "external",
        "summary": "2011805",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011805"
      },
      {
        "category": "external",
        "summary": "2012130",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2012130"
      },
      {
        "category": "external",
        "summary": "2012564",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2012564"
      },
      {
        "category": "external",
        "summary": "2012732",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2012732"
      },
      {
        "category": "external",
        "summary": "2012799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2012799"
      },
      {
        "category": "external",
        "summary": "2013687",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2013687"
      },
      {
        "category": "external",
        "summary": "2014157",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014157"
      },
      {
        "category": "external",
        "summary": "2014177",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014177"
      },
      {
        "category": "external",
        "summary": "2015063",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2015063"
      },
      {
        "category": "external",
        "summary": "2015813",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2015813"
      },
      {
        "category": "external",
        "summary": "2015816",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2015816"
      },
      {
        "category": "external",
        "summary": "2015940",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2015940"
      },
      {
        "category": "external",
        "summary": "2016257",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2016257"
      },
      {
        "category": "external",
        "summary": "2016931",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2016931"
      },
      {
        "category": "external",
        "summary": "2017370",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2017370"
      },
      {
        "category": "external",
        "summary": "2017625",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2017625"
      },
      {
        "category": "external",
        "summary": "2018522",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2018522"
      },
      {
        "category": "external",
        "summary": "2018939",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2018939"
      },
      {
        "category": "external",
        "summary": "2018944",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2018944"
      },
      {
        "category": "external",
        "summary": "2019307",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019307"
      },
      {
        "category": "external",
        "summary": "2020014",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020014"
      },
      {
        "category": "external",
        "summary": "2020297",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020297"
      },
      {
        "category": "external",
        "summary": "2021622",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2021622"
      },
      {
        "category": "external",
        "summary": "2022651",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2022651"
      },
      {
        "category": "external",
        "summary": "2023680",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2023680"
      },
      {
        "category": "external",
        "summary": "2024138",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024138"
      },
      {
        "category": "external",
        "summary": "2024506",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024506"
      },
      {
        "category": "external",
        "summary": "2024554",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024554"
      },
      {
        "category": "external",
        "summary": "2025279",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025279"
      },
      {
        "category": "external",
        "summary": "2025526",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025526"
      },
      {
        "category": "external",
        "summary": "2026620",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026620"
      },
      {
        "category": "external",
        "summary": "2026702",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026702"
      },
      {
        "category": "external",
        "summary": "2026804",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026804"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhea-2021_5066.json"
      }
    ],
    "title": "Red Hat Enhancement Advisory: MTV 2.2.0 Images",
    "tracking": {
      "current_release_date": "2026-03-20T01:18:16+00:00",
      "generator": {
        "date": "2026-03-20T01:18:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHEA-2021:5066",
      "initial_release_date": "2021-12-09T19:19:24+00:00",
      "revision_history": [
        {
          "date": "2021-12-09T19:19:24+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-12-09T19:19:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-20T01:18:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "8Base-MTV-2.2",
                "product": {
                  "name": "8Base-MTV-2.2",
                  "product_id": "8Base-MTV-2.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:migration_toolkit_virtualization:2.2::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Migration Toolkit for Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64",
                "product": {
                  "name": "migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64",
                  "product_id": "migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel8\u0026tag=2.2.0-39"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
                "product": {
                  "name": "migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
                  "product_id": "migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-api-rhel8\u0026tag=2.2.0-53"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
                "product": {
                  "name": "migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
                  "product_id": "migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-must-gather-rhel8\u0026tag=2.2.0-57"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
                "product": {
                  "name": "migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
                  "product_id": "migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle\u0026tag=2.2.0-104"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
                "product": {
                  "name": "migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
                  "product_id": "migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-rhel8-operator\u0026tag=2.2.0-59"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64",
                "product": {
                  "name": "migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64",
                  "product_id": "migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-ui-rhel8\u0026tag=2.2.0-60"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
                "product": {
                  "name": "migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
                  "product_id": "migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel8\u0026tag=2.2.0-36"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64",
                "product": {
                  "name": "migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64",
                  "product_id": "migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0?arch=amd64\u0026repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel8\u0026tag=2.2.0-18"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64 as a component of 8Base-MTV-2.2",
          "product_id": "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64"
        },
        "product_reference": "migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64",
        "relates_to_product_reference": "8Base-MTV-2.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64 as a component of 8Base-MTV-2.2",
          "product_id": "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64"
        },
        "product_reference": "migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
        "relates_to_product_reference": "8Base-MTV-2.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64 as a component of 8Base-MTV-2.2",
          "product_id": "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64"
        },
        "product_reference": "migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
        "relates_to_product_reference": "8Base-MTV-2.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64 as a component of 8Base-MTV-2.2",
          "product_id": "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64"
        },
        "product_reference": "migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
        "relates_to_product_reference": "8Base-MTV-2.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64 as a component of 8Base-MTV-2.2",
          "product_id": "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64"
        },
        "product_reference": "migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
        "relates_to_product_reference": "8Base-MTV-2.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64 as a component of 8Base-MTV-2.2",
          "product_id": "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64"
        },
        "product_reference": "migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64",
        "relates_to_product_reference": "8Base-MTV-2.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64 as a component of 8Base-MTV-2.2",
          "product_id": "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64"
        },
        "product_reference": "migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
        "relates_to_product_reference": "8Base-MTV-2.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64 as a component of 8Base-MTV-2.2",
          "product_id": "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64"
        },
        "product_reference": "migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64",
        "relates_to_product_reference": "8Base-MTV-2.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3749",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-08-31T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1999784"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A Regular Expression Denial of Service (ReDoS) vulnerability was found in the nodejs axios. This flaw allows an attacker to provide crafted input to the trim function, which might cause high resources consumption and as a consequence lead to denial of service. The highest threat from this vulnerability is system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-axios: Regular expression denial of service in trim function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "* OpenShift Container Platform (OCP) grafana-container does package a vulnerable version of nodejs axios. However, due to the instance being read only and behind OpenShift OAuth, the impact of this vulnerability is Low.\n\n* Red Hat Advanced Cluster Management for Kubernetes (RHACM) 2.1 and previous versions does contain a vulnerable version of nodejs axios, RHACM 2.2 on towards are not affected versions. For RHACM 2.1, due to the instance being read only and behind OAuth, the impact of this vulnerability is Low.\n\n* Because Service Telemetry Framework 1.2 will be retiring soon and the flaw\u0027s impact is lower, no update will be provided at this time for STF\u0027s service-telemetry-operator-container and smart-gateway-operator-container.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64"
        ],
        "known_not_affected": [
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-3749"
        },
        {
          "category": "external",
          "summary": "RHBZ#1999784",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999784"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3749",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3749"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3749",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3749"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929",
          "url": "https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929"
        },
        {
          "category": "external",
          "summary": "https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31",
          "url": "https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31"
        }
      ],
      "release_date": "2021-08-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-12-09T19:19:24+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n        https://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHEA-2021:5066"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs-axios: Regular expression denial of service in trim function"
    },
    {
      "cve": "CVE-2021-41089",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2021-09-27T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2008592"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A file permissions vulnerability was found in Moby (Docker Engine). Copying files by using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host\u0027s filesystem, which might lead to permissions escalation and allow an attacker access to restricted data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "moby: `docker cp` allows unexpected chmod of host file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), Migration Toolkit for Virtualization (MTV) and Red Hat Quay some components bundle github.com/moby/moby, but successful exploitation requires using a specially crafted container, therefore impact to these components is LOW.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64"
        ],
        "known_not_affected": [
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
          "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-41089"
        },
        {
          "category": "external",
          "summary": "RHBZ#2008592",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2008592"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-41089",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-41089"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41089",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41089"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4",
          "url": "https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-12-09T19:19:24+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\n        https://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHEA-2021:5066"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-controller-rhel8@sha256:2cce5613b712523a5f5c869cbb70bc7c345abf3082cf0e4bac6bba10c964ac6b_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:cf63280768f5a5f1c71463e4fc6824e225f5c3041979c37d9c8c6009bb2cc618_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:b74533ee63f91871e662d53b8723b0ff9d6cb9669e1d643b2a2079007eb36b1b_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-operator-bundle@sha256:8052eca4ff2643bc7be9cd72e00b18015c9a7abc6421f61a454b418c84342c94_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-rhel8-operator@sha256:d6ff4e314aaf9e32a9250640e1b68e91c6d9c1ed379af2d8294f2595daef5312_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-ui-rhel8@sha256:675034f89ec601cc7755315b42ddda61fa2395397d7c57a270c1d0149058d8f3_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-validation-rhel8@sha256:f4739e4508739b0ecf493aaa7531b8463776499038097b2d19adbc3eb32724af_amd64",
            "8Base-MTV-2.2:migration-toolkit-virtualization/mtv-virt-v2v-rhel8@sha256:1fa55d7af17e5c0d02ca6ea49b12339a8c6fd62d6131c993031cdb0e6cecaec0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "moby: `docker cp` allows unexpected chmod of host file"
    }
  ]
}