Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-1967 (GCVE-0-2020-1967)
Vulnerability from cvelistv5 – Published: 2020-04-21 13:45 – Updated: 2024-09-17 03:13
VLAI
EPSS
Title
Segmentation fault in SSL_check_chain
Summary
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Severity
No CVSS data available.
CWE
- NULL pointer dereference
Assigner
References
32 references
Impacted products
Date Public
2020-04-21 00:00
Credits
Bernd Edlinger
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:54:00.398Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FreeBSD-SA-20:11",
"tags": [
"vendor-advisory",
"x_refsource_FREEBSD",
"x_transferred"
],
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc"
},
{
"name": "DSA-4661",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4661"
},
{
"name": "[oss-security] 20200422 [CVE-2020-1967] OpenSSL 1.1.1d+ Segmentation fault in SSL_check_chain",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2020/04/22/2"
},
{
"name": "[tomcat-dev] 20200422 Time for Tomcat Native 1.2.24?",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200422 Re: Time for Tomcat Native 1.2.24?",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200423 Re: Time for Tomcat Native 1.2.24?",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "GLSA-202004-10",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202004-10"
},
{
"name": "FEDORA-2020-fcc91a28e8",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/"
},
{
"name": "FEDORA-2020-da2d1ef2d7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/"
},
{
"name": "20200501 CVE-2020-1967: proving sigalg != NULL",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2020/May/5"
},
{
"name": "FEDORA-2020-d7b29838f6",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/"
},
{
"name": "openSUSE-SU-2020:0933",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html"
},
{
"name": "openSUSE-SU-2020:0945",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tenable.com/security/tns-2020-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openssl.org/news/secadv/20200421.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200424-0003/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/irsl/CVE-2020-1967"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tenable.com/security/tns-2020-04"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200717-0004/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"status": "affected",
"version": "Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Bernd Edlinger"
}
],
"datePublic": "2020-04-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)."
}
],
"metrics": [
{
"other": {
"content": {
"lang": "eng",
"url": "https://www.openssl.org/policies/secpolicy.html#High",
"value": "High"
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "NULL pointer dereference",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-20T10:39:19.000Z",
"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"shortName": "openssl"
},
"references": [
{
"name": "FreeBSD-SA-20:11",
"tags": [
"vendor-advisory",
"x_refsource_FREEBSD"
],
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc"
},
{
"name": "DSA-4661",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2020/dsa-4661"
},
{
"name": "[oss-security] 20200422 [CVE-2020-1967] OpenSSL 1.1.1d+ Segmentation fault in SSL_check_chain",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2020/04/22/2"
},
{
"name": "[tomcat-dev] 20200422 Time for Tomcat Native 1.2.24?",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200422 Re: Time for Tomcat Native 1.2.24?",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200423 Re: Time for Tomcat Native 1.2.24?",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "GLSA-202004-10",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202004-10"
},
{
"name": "FEDORA-2020-fcc91a28e8",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/"
},
{
"name": "FEDORA-2020-da2d1ef2d7",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/"
},
{
"name": "20200501 CVE-2020-1967: proving sigalg != NULL",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2020/May/5"
},
{
"name": "FEDORA-2020-d7b29838f6",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/"
},
{
"name": "openSUSE-SU-2020:0933",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html"
},
{
"name": "openSUSE-SU-2020:0945",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tenable.com/security/tns-2020-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openssl.org/news/secadv/20200421.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20200424-0003/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/irsl/CVE-2020-1967"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tenable.com/security/tns-2020-04"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20200717-0004/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
}
],
"title": "Segmentation fault in SSL_check_chain",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "openssl-security@openssl.org",
"DATE_PUBLIC": "2020-04-21",
"ID": "CVE-2020-1967",
"STATE": "PUBLIC",
"TITLE": "Segmentation fault in SSL_check_chain"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenSSL",
"version": {
"version_data": [
{
"version_value": "Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)"
}
]
}
}
]
},
"vendor_name": "OpenSSL"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Bernd Edlinger"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)."
}
]
},
"impact": [
{
"lang": "eng",
"url": "https://www.openssl.org/policies/secpolicy.html#High",
"value": "High"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "NULL pointer dereference"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FreeBSD-SA-20:11",
"refsource": "FREEBSD",
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc"
},
{
"name": "DSA-4661",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4661"
},
{
"name": "[oss-security] 20200422 [CVE-2020-1967] OpenSSL 1.1.1d+ Segmentation fault in SSL_check_chain",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2020/04/22/2"
},
{
"name": "[tomcat-dev] 20200422 Time for Tomcat Native 1.2.24?",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200422 Re: Time for Tomcat Native 1.2.24?",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200423 Re: Time for Tomcat Native 1.2.24?",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "GLSA-202004-10",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202004-10"
},
{
"name": "FEDORA-2020-fcc91a28e8",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/"
},
{
"name": "FEDORA-2020-da2d1ef2d7",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/"
},
{
"name": "20200501 CVE-2020-1967: proving sigalg != NULL",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2020/May/5"
},
{
"name": "FEDORA-2020-d7b29838f6",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/"
},
{
"name": "openSUSE-SU-2020:0933",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html"
},
{
"name": "openSUSE-SU-2020:0945",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"name": "https://www.tenable.com/security/tns-2020-03",
"refsource": "CONFIRM",
"url": "https://www.tenable.com/security/tns-2020-03"
},
{
"name": "https://www.openssl.org/news/secadv/20200421.txt",
"refsource": "CONFIRM",
"url": "https://www.openssl.org/news/secadv/20200421.txt"
},
{
"name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1",
"refsource": "CONFIRM",
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1"
},
{
"name": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440",
"refsource": "CONFIRM",
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200424-0003/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200424-0003/"
},
{
"name": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL",
"refsource": "CONFIRM",
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL"
},
{
"name": "https://github.com/irsl/CVE-2020-1967",
"refsource": "MISC",
"url": "https://github.com/irsl/CVE-2020-1967"
},
{
"name": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html"
},
{
"name": "https://www.synology.com/security/advisory/Synology_SA_20_05",
"refsource": "CONFIRM",
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05"
},
{
"name": "https://www.tenable.com/security/tns-2020-04",
"refsource": "CONFIRM",
"url": "https://www.tenable.com/security/tns-2020-04"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200717-0004/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200717-0004/"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"name": "https://www.tenable.com/security/tns-2020-11",
"refsource": "CONFIRM",
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"name": "https://www.tenable.com/security/tns-2021-10",
"refsource": "CONFIRM",
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"name": "https://www.oracle.com//security-alerts/cpujul2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"assignerShortName": "openssl",
"cveId": "CVE-2020-1967",
"datePublished": "2020-04-21T13:45:15.136Z",
"dateReserved": "2019-12-03T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:13:46.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2020-1967",
"date": "2026-06-05",
"epss": "0.60769",
"percentile": "0.98324"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2020-1967\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2020-04-21T14:15:11.287\",\"lastModified\":\"2024-11-21T05:11:45.023\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \\\"signature_algorithms_cert\\\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).\"},{\"lang\":\"es\",\"value\":\"Las aplicaciones de Servidor o Cliente que llaman a la funci\u00f3n SSL_check_chain() durante o despu\u00e9s del protocolo de enlace de TLS versi\u00f3n 1.3, puede bloquear debido a una desreferencia del puntero NULL como resultado de un manejo incorrecto de la extensi\u00f3n TLS \\\"signature_algorithms_cert\\\". El bloqueo ocurre si se recibe un algoritmo de firma no comprobada o ni reconocido del peer. Esto podr\u00eda ser explotado por un peer malicioso en un ataque de Denegaci\u00f3n de Servicio. OpenSSL versiones 1.1.1d, 1.1.1e y 1.1.1f est\u00e1n afectadas por este problema. Este problema no afectaba a OpenSSL versiones anteriores a la versi\u00f3n 1.1.1d. Corregido en OpenSSL versi\u00f3n 1.1.1g (Afectado en la versi\u00f3n 1.1.1d-1.1.1f).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.1d\",\"versionEndIncluding\":\"1.1.1f\",\"matchCriteriaId\":\"90907017-473C-48CA-9441-DAFAF5F81049\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD730B6A-F123-4685-ACB3-4F20AAAB77F3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97A4B8DF-58DA-4AB6-A1F9-331B36409BA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:application_server:12.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDD7E6AC-A613-4938-91D1-402DA2038875\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26F3E23-F1A9-45E7-9E5F-0C0A24EE3783\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F87918FE-62C0-4DC5-8894-847DFB5B7E5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61516569-C48F-4362-B334-8CA10EDB0EC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"37209C6F-EF99-4D21-9608-B3A06D283D24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD04BEE5-E9A8-4584-A68C-0195CE9C402C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B1CAD50-749F-4ADB-A046-BF3585677A58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"5.6.48\",\"matchCriteriaId\":\"C6C5EC81-F74A-4280-A041-EC5EE36D0919\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.7.0\",\"versionEndIncluding\":\"5.7.30\",\"matchCriteriaId\":\"E1A68EF8-15AA-42A7-9734-6F9470EB35CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndIncluding\":\"8.0.20\",\"matchCriteriaId\":\"0E1A3769-E443-4511-B349-B5304F5E6EBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.0.20\",\"matchCriteriaId\":\"7F198EB3-A3AB-42EA-BF3A-D8BB4D9210EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.0.12\",\"matchCriteriaId\":\"9A3BBE71-CA00-4F54-9210-FC7572C87CFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndIncluding\":\"8.0.20\",\"matchCriteriaId\":\"73573516-EDA0-4176-A3ED-2F7006C87F8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"8.0.21\",\"matchCriteriaId\":\"9E07B577-50FE-43B4-8AAD-4C267A494A36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0A735B4-4F3C-416B-8C08-9CB21BAD2889\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E1E416B-920B-49A0-9523-382898C2979D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8AF00C6-B97F-414D-A8DF-057E6BFD8597\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*\",\"versionStartIncluding\":\"7.3\",\"matchCriteriaId\":\"BD075607-09B7-493E-8611-66D041FFDA62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*\",\"versionStartIncluding\":\"9.5\",\"matchCriteriaId\":\"0CB28AF5-5AF0-4475-A7B6-12E1795FFDCB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B8DB06-590A-4008-B0AB-FCD1401C77C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5735E553-9731-4AAC-BCFF-989377F817B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BB0FDCF-3750-44C6-AC5C-0CC2AAD14093\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDFB1169-41A0-4A86-8E4F-FDA9730B1E94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E94F7F59-1785-493F-91A7-5F5EA5E87E4D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"046FB51E-B768-44D3-AEB5-D857145CA840\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B620311B-34A3-48A6-82DF-6F078D7A4493\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B009C22E-30A4-4288-BCF6-C3E81DEAF45A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jdedwards:enterpriseone:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.2.5.0\",\"matchCriteriaId\":\"0E4475E9-FF6F-4B94-8989-D8E2EB69F782\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.0.9\",\"matchCriteriaId\":\"4ACF85D6-6B45-43DA-9C01-F0208186F014\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/May/5\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2020/04/22/2\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://github.com/irsl/CVE-2020-1967\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202004-10\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200424-0003/\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200717-0004/\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4661\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.openssl.org/news/secadv/20200421.txt\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.synology.com/security/advisory/Synology_SA_20_05\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-03\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-04\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-11\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-10\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/May/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2020/04/22/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/irsl/CVE-2020-1967\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202004-10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200424-0003/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200717-0004/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4661\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.openssl.org/news/secadv/20200421.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.synology.com/security/advisory/Synology_SA_20_05\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-04\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
CERTFR-2021-AVI-804
Vulnerability from certfr_avis - Published: 2021-10-20 - Updated: 2021-10-20
De multiples vulnérabilités ont été découvertes dans Oracle PeopleSoft. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Oracle | PeopleSoft | PeopleSoft Enterprise PeopleTools version 8.57 | ||
| Oracle | PeopleSoft | PeopleSoft Enterprise CC Common Application Objects version 9.2 | ||
| Oracle | PeopleSoft | PeopleSoft Enterprise SCM version 9.2 | ||
| Oracle | PeopleSoft | PeopleSoft Enterprise PeopleTools version 8.58 | ||
| Oracle | PeopleSoft | PeopleSoft Enterprise PeopleTools version 8.59 | ||
| Oracle | PeopleSoft | PeopleSoft Enterprise CS SA Integration Pack version 9.2 | ||
| Oracle | PeopleSoft | PeopleSoft Enterprise CS Academic Advisement version 9.2 | ||
| Oracle | PeopleSoft | PeopleSoft Enterprise CS SA Integration Pack version 9.0 | ||
| Oracle | PeopleSoft | PeopleSoft Enterprise CS Student Records version 9.2 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PeopleSoft Enterprise PeopleTools version 8.57",
"product": {
"name": "PeopleSoft",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "PeopleSoft Enterprise CC Common Application Objects version 9.2",
"product": {
"name": "PeopleSoft",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "PeopleSoft Enterprise SCM version 9.2",
"product": {
"name": "PeopleSoft",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "PeopleSoft Enterprise PeopleTools version 8.58",
"product": {
"name": "PeopleSoft",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "PeopleSoft Enterprise PeopleTools version 8.59",
"product": {
"name": "PeopleSoft",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "PeopleSoft Enterprise CS SA Integration Pack version 9.2",
"product": {
"name": "PeopleSoft",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "PeopleSoft Enterprise CS Academic Advisement version 9.2",
"product": {
"name": "PeopleSoft",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "PeopleSoft Enterprise CS SA Integration Pack version 9.0",
"product": {
"name": "PeopleSoft",
"vendor": {
"name": "Oracle",
"scada": false
}
}
},
{
"description": "PeopleSoft Enterprise CS Student Records version 9.2",
"product": {
"name": "PeopleSoft",
"vendor": {
"name": "Oracle",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-29425",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29425"
},
{
"name": "CVE-2021-27906",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27906"
},
{
"name": "CVE-2021-35595",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35595"
},
{
"name": "CVE-2021-35541",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35541"
},
{
"name": "CVE-2020-13956",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13956"
},
{
"name": "CVE-2021-36090",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36090"
},
{
"name": "CVE-2021-35609",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35609"
},
{
"name": "CVE-2021-35571",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35571"
},
{
"name": "CVE-2021-23926",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23926"
},
{
"name": "CVE-2021-35553",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35553"
},
{
"name": "CVE-2021-35601",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35601"
},
{
"name": "CVE-2021-35606",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35606"
},
{
"name": "CVE-2019-12415",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12415"
},
{
"name": "CVE-2021-28363",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28363"
},
{
"name": "CVE-2021-35543",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35543"
},
{
"name": "CVE-2021-35568",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35568"
},
{
"name": "CVE-2020-1967",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1967"
}
],
"initial_release_date": "2021-10-20T00:00:00",
"last_revision_date": "2021-10-20T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-804",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-10-20T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Oracle PeopleSoft.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0\ndistance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Oracle PeopleSoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Oracle cpuoct2021 du 19 octobre 2021",
"url": "https://www.oracle.com/security-alerts/cpuoct2021verbose.html#PS"
}
]
}
CERTFR-2024-AVI-0119
Vulnerability from certfr_avis - Published: 2024-02-13 - Updated: 2024-02-13
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une élévation de privilèges et une exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) versions antérieures à V2.4 | ||
| Siemens | N/A | SCALANCE XCM332 (6GK5332-0GA01-2AC2) versions antérieures à V2.4 | ||
| Siemens | N/A | SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) versions antérieures à V2.4 | ||
| Siemens | N/A | Simcenter Femap versions antérieures à V2401.0000 | ||
| Siemens | N/A | SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) versions antérieures à V2.4 | ||
| Siemens | N/A | Parasolid V36.0 versions antérieures à V36.0.198 | ||
| Siemens | N/A | SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) versions antérieures à V2.4 | ||
| Siemens | N/A | SCALANCE SC646-2C (6GK5646-2GS00-2AC2) versions antérieures à V3.1 | ||
| Siemens | N/A | SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) versions antérieures à V2.4 | ||
| Siemens | N/A | SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) versions antérieures à V2.4 | ||
| Siemens | N/A | SCALANCE SC636-2C (6GK5636-2GS00-2AC2) versions antérieures à V3.1 | ||
| Siemens | N/A | Location Intelligence SUS Small (9DE5110-8CA11-1BX0) versions antérieures à V4.3 | ||
| Siemens | N/A | SIMATIC WinCC V7.5 versions antérieures à V7.5 SP2 Update 15 | ||
| Siemens | N/A | SINEC NMS versions antérieures à V2.0 SP1 | ||
| Siemens | N/A | SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) versions antérieures à V2.4 | ||
| Siemens | N/A | SIMATIC WinCC V8.0 versions antérieures à V8.0 SP4 | ||
| Siemens | N/A | SIDIS Prime versions antérieures à V4.0.400 | ||
| Siemens | N/A | SCALANCE XCH328 (6GK5328-4TS01-2EC2) versions antérieures à V2.4 | ||
| Siemens | N/A | Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) versions antérieures à V4.3 | ||
| Siemens | N/A | SCALANCE SC642-2C (6GK5642-2GS00-2AC2) versions antérieures à V3.1 | ||
| Siemens | N/A | SCALANCE XCM324 (6GK5324-8TS01-2AC2) versions antérieures à V2.4 | ||
| Siemens | N/A | Parasolid V35.1 versions antérieures à V35.1.252 | ||
| Siemens | N/A | Tecnomatix Plant Simulation V2201 versions antérieures à V2201.0012 | ||
| Siemens | N/A | RUGGEDCOM APE1808 avec Nozomi Guardian / CMC antérieures à 23.3.0 | ||
| Siemens | N/A | Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) versions antérieures à V4.3 | ||
| Siemens | N/A | SCALANCE SC632-2C (6GK5632-2GS00-2AC2) versions antérieures à V3.1 | ||
| Siemens | N/A | Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) versions antérieures à V4.3 | ||
| Siemens | N/A | Location Intelligence SUS Large (9DE5110-8CA13-1BX0) versions antérieures à V4.3 | ||
| Siemens | N/A | SCALANCE XCM328 (6GK5328-4TS01-2AC2) versions antérieures à V2.4 | ||
| Siemens | N/A | SCALANCE SC626-2C (6GK5626-2GS00-2AC2) versions antérieures à V3.1 | ||
| Siemens | N/A | Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) versions antérieures à V4.3 | ||
| Siemens | N/A | Tecnomatix Plant Simulation V2302 versions antérieures à V2302.0006 | ||
| Siemens | N/A | Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) versions antérieures à V4.3 | ||
| Siemens | N/A | SCALANCE SC622-2C (6GK5622-2GS00-2AC2) versions antérieures à V3.1 | ||
| Siemens | N/A | Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) versions antérieures à V4.3 | ||
| Siemens | N/A | Parasolid V35.0 versions antérieures à V35.0.263 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XCM332 (6GK5332-0GA01-2AC2) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Simcenter Femap versions ant\u00e9rieures \u00e0 V2401.0000",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Parasolid V36.0 versions ant\u00e9rieures \u00e0 V36.0.198",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC646-2C (6GK5646-2GS00-2AC2) versions ant\u00e9rieures \u00e0 V3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC636-2C (6GK5636-2GS00-2AC2) versions ant\u00e9rieures \u00e0 V3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Location Intelligence SUS Small (9DE5110-8CA11-1BX0) versions ant\u00e9rieures \u00e0 V4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC V7.5 versions ant\u00e9rieures \u00e0 V7.5 SP2 Update 15",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC NMS versions ant\u00e9rieures \u00e0 V2.0 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC V8.0 versions ant\u00e9rieures \u00e0 V8.0 SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIDIS Prime versions ant\u00e9rieures \u00e0 V4.0.400",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XCH328 (6GK5328-4TS01-2EC2) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) versions ant\u00e9rieures \u00e0 V4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC642-2C (6GK5642-2GS00-2AC2) versions ant\u00e9rieures \u00e0 V3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XCM324 (6GK5324-8TS01-2AC2) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Parasolid V35.1 versions ant\u00e9rieures \u00e0 V35.1.252",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Tecnomatix Plant Simulation V2201 versions ant\u00e9rieures \u00e0 V2201.0012",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM APE1808 avec Nozomi Guardian / CMC ant\u00e9rieures \u00e0 23.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) versions ant\u00e9rieures \u00e0 V4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC632-2C (6GK5632-2GS00-2AC2) versions ant\u00e9rieures \u00e0 V3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) versions ant\u00e9rieures \u00e0 V4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Location Intelligence SUS Large (9DE5110-8CA13-1BX0) versions ant\u00e9rieures \u00e0 V4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE XCM328 (6GK5328-4TS01-2AC2) versions ant\u00e9rieures \u00e0 V2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC626-2C (6GK5626-2GS00-2AC2) versions ant\u00e9rieures \u00e0 V3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) versions ant\u00e9rieures \u00e0 V4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Tecnomatix Plant Simulation V2302 versions ant\u00e9rieures \u00e0 V2302.0006",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) versions ant\u00e9rieures \u00e0 V4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SCALANCE SC622-2C (6GK5622-2GS00-2AC2) versions ant\u00e9rieures \u00e0 V3.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) versions ant\u00e9rieures \u00e0 V4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Parasolid V35.0 versions ant\u00e9rieures \u00e0 V35.0.263",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-0216",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0216"
},
{
"name": "CVE-2023-49691",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49691"
},
{
"name": "CVE-2022-46393",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-46393"
},
{
"name": "CVE-2023-0401",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0401"
},
{
"name": "CVE-2022-41556",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41556"
},
{
"name": "CVE-2023-3316",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3316"
},
{
"name": "CVE-2023-3006",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3006"
},
{
"name": "CVE-2023-51440",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51440"
},
{
"name": "CVE-2023-23946",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23946"
},
{
"name": "CVE-2023-28466",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28466"
},
{
"name": "CVE-2023-1838",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1838"
},
{
"name": "CVE-2023-30772",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30772"
},
{
"name": "CVE-2023-45622",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45622"
},
{
"name": "CVE-2023-44321",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44321"
},
{
"name": "CVE-2022-29162",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29162"
},
{
"name": "CVE-2023-30585",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30585"
},
{
"name": "CVE-2024-23803",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23803"
},
{
"name": "CVE-2023-38546",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38546"
},
{
"name": "CVE-2023-44317",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44317"
},
{
"name": "CVE-2023-38199",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38199"
},
{
"name": "CVE-2022-36760",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36760"
},
{
"name": "CVE-2022-47629",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47629"
},
{
"name": "CVE-2023-29404",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29404"
},
{
"name": "CVE-2023-23454",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23454"
},
{
"name": "CVE-2021-45451",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45451"
},
{
"name": "CVE-2022-26691",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26691"
},
{
"name": "CVE-2022-4304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
},
{
"name": "CVE-2023-37920",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37920"
},
{
"name": "CVE-2023-30583",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30583"
},
{
"name": "CVE-2021-36369",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36369"
},
{
"name": "CVE-2023-25727",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25727"
},
{
"name": "CVE-2023-30086",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30086"
},
{
"name": "CVE-2022-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41409"
},
{
"name": "CVE-2023-3390",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3390"
},
{
"name": "CVE-2023-0330",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0330"
},
{
"name": "CVE-2023-2002",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2002"
},
{
"name": "CVE-2024-23812",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23812"
},
{
"name": "CVE-2023-26965",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26965"
},
{
"name": "CVE-2023-3817",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3817"
},
{
"name": "CVE-2023-45617",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45617"
},
{
"name": "CVE-2023-31124",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31124"
},
{
"name": "CVE-2024-24925",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24925"
},
{
"name": "CVE-2022-45061",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45061"
},
{
"name": "CVE-2024-22042",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22042"
},
{
"name": "CVE-2023-50236",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50236"
},
{
"name": "CVE-2022-23521",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23521"
},
{
"name": "CVE-2023-40283",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40283"
},
{
"name": "CVE-2022-41715",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41715"
},
{
"name": "CVE-2022-28739",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28739"
},
{
"name": "CVE-2022-41903",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41903"
},
{
"name": "CVE-2023-23934",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23934"
},
{
"name": "CVE-2022-4904",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4904"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2023-35788",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35788"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2023-32067",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32067"
},
{
"name": "CVE-2024-23816",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23816"
},
{
"name": "CVE-2022-3515",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3515"
},
{
"name": "CVE-2023-1393",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1393"
},
{
"name": "CVE-2006-20001",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-20001"
},
{
"name": "CVE-2022-36021",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36021"
},
{
"name": "CVE-2022-39189",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39189"
},
{
"name": "CVE-2024-24922",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24922"
},
{
"name": "CVE-2022-38725",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38725"
},
{
"name": "CVE-2024-24923",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24923"
},
{
"name": "CVE-2022-39260",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39260"
},
{
"name": "CVE-2022-29862",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29862"
},
{
"name": "CVE-2024-23800",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23800"
},
{
"name": "CVE-2023-39417",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39417"
},
{
"name": "CVE-2023-28322",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28322"
},
{
"name": "CVE-2023-29405",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29405"
},
{
"name": "CVE-2022-3437",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3437"
},
{
"name": "CVE-2020-10735",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10735"
},
{
"name": "CVE-2022-4743",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4743"
},
{
"name": "CVE-2023-1989",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1989"
},
{
"name": "CVE-2022-28738",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28738"
},
{
"name": "CVE-2023-1855",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1855"
},
{
"name": "CVE-2023-3247",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3247"
},
{
"name": "CVE-2023-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25193"
},
{
"name": "CVE-2023-32559",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32559"
},
{
"name": "CVE-2023-0494",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0494"
},
{
"name": "CVE-2023-35828",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35828"
},
{
"name": "CVE-2022-37797",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37797"
},
{
"name": "CVE-2022-32148",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32148"
},
{
"name": "CVE-2022-4203",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4203"
},
{
"name": "CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"name": "CVE-2023-31084",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31084"
},
{
"name": "CVE-2023-3090",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3090"
},
{
"name": "CVE-2022-45919",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45919"
},
{
"name": "CVE-2024-24921",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24921"
},
{
"name": "CVE-2023-28320",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28320"
},
{
"name": "CVE-2023-45625",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45625"
},
{
"name": "CVE-2023-3611",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3611"
},
{
"name": "CVE-2023-4128",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4128"
},
{
"name": "CVE-2023-31436",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31436"
},
{
"name": "CVE-2023-32558",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32558"
},
{
"name": "CVE-2023-2194",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2194"
},
{
"name": "CVE-2023-33203",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33203"
},
{
"name": "CVE-2022-41861",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41861"
},
{
"name": "CVE-2024-23813",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23813"
},
{
"name": "CVE-2022-34918",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34918"
},
{
"name": "CVE-2023-0217",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0217"
},
{
"name": "CVE-2024-23802",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23802"
},
{
"name": "CVE-2021-43666",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43666"
},
{
"name": "CVE-2023-22490",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22490"
},
{
"name": "CVE-2023-0568",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0568"
},
{
"name": "CVE-2024-23798",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23798"
},
{
"name": "CVE-2023-28319",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28319"
},
{
"name": "CVE-2023-32003",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32003"
},
{
"name": "CVE-2023-1859",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1859"
},
{
"name": "CVE-2023-48363",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48363"
},
{
"name": "CVE-2022-1015",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1015"
},
{
"name": "CVE-2023-32004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32004"
},
{
"name": "CVE-2023-44320",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44320"
},
{
"name": "CVE-2022-29187",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29187"
},
{
"name": "CVE-2023-3111",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3111"
},
{
"name": "CVE-2023-28709",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28709"
},
{
"name": "CVE-2023-30587",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30587"
},
{
"name": "CVE-2023-30589",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30589"
},
{
"name": "CVE-2022-46392",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-46392"
},
{
"name": "CVE-2023-28487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28487"
},
{
"name": "CVE-2023-1670",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1670"
},
{
"name": "CVE-2023-31489",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31489"
},
{
"name": "CVE-2023-32005",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32005"
},
{
"name": "CVE-2023-45618",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45618"
},
{
"name": "CVE-2023-20593",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20593"
},
{
"name": "CVE-2024-23810",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23810"
},
{
"name": "CVE-2023-30582",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30582"
},
{
"name": "CVE-2023-23931",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23931"
},
{
"name": "CVE-2022-41862",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41862"
},
{
"name": "CVE-2019-19135",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19135"
},
{
"name": "CVE-2022-28737",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28737"
},
{
"name": "CVE-2023-31147",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31147"
},
{
"name": "CVE-2022-45142",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45142"
},
{
"name": "CVE-2023-22742",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22742"
},
{
"name": "CVE-2022-2586",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2586"
},
{
"name": "CVE-2022-36227",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36227"
},
{
"name": "CVE-2023-27522",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27522"
},
{
"name": "CVE-2022-37454",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37454"
},
{
"name": "CVE-2022-48434",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48434"
},
{
"name": "CVE-2023-25155",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25155"
},
{
"name": "CVE-2023-0160",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0160"
},
{
"name": "CVE-2023-5253",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5253"
},
{
"name": "CVE-2023-27535",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27535"
},
{
"name": "CVE-2022-42919",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42919"
},
{
"name": "CVE-2023-49125",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49125"
},
{
"name": "CVE-2021-3445",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3445"
},
{
"name": "CVE-2023-30581",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30581"
},
{
"name": "CVE-2023-45627",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45627"
},
{
"name": "CVE-2023-29406",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29406"
},
{
"name": "CVE-2023-30584",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30584"
},
{
"name": "CVE-2024-23801",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23801"
},
{
"name": "CVE-2024-24924",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24924"
},
{
"name": "CVE-2022-4744",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4744"
},
{
"name": "CVE-2023-35945",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35945"
},
{
"name": "CVE-2023-36664",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36664"
},
{
"name": "CVE-2023-21255",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21255"
},
{
"name": "CVE-2023-1990",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1990"
},
{
"name": "CVE-2022-41717",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41717"
},
{
"name": "CVE-2021-4037",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4037"
},
{
"name": "CVE-2023-28321",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28321"
},
{
"name": "CVE-2023-36617",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36617"
},
{
"name": "CVE-2023-38559",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38559"
},
{
"name": "CVE-2023-35824",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35824"
},
{
"name": "CVE-2023-45616",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45616"
},
{
"name": "CVE-2023-45624",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45624"
},
{
"name": "CVE-2023-45614",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45614"
},
{
"name": "CVE-2023-35823",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35823"
},
{
"name": "CVE-2023-46120",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46120"
},
{
"name": "CVE-2023-30586",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30586"
},
{
"name": "CVE-2023-30588",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30588"
},
{
"name": "CVE-2023-1380",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1380"
},
{
"name": "CVE-2023-3776",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3776"
},
{
"name": "CVE-2023-44319",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44319"
},
{
"name": "CVE-2022-2880",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2880"
},
{
"name": "CVE-2024-23811",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23811"
},
{
"name": "CVE-2023-35789",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35789"
},
{
"name": "CVE-2023-25153",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25153"
},
{
"name": "CVE-2022-4450",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4450"
},
{
"name": "CVE-2024-22043",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22043"
},
{
"name": "CVE-2023-2650",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2650"
},
{
"name": "CVE-2023-4194",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4194"
},
{
"name": "CVE-2023-39418",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39418"
},
{
"name": "CVE-2023-2454",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2454"
},
{
"name": "CVE-2023-27534",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27534"
},
{
"name": "CVE-2023-27536",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27536"
},
{
"name": "CVE-2023-2269",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2269"
},
{
"name": "CVE-2022-29154",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29154"
},
{
"name": "CVE-2023-27533",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27533"
},
{
"name": "CVE-2023-26081",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26081"
},
{
"name": "CVE-2022-34903",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34903"
},
{
"name": "CVE-2023-44322",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44322"
},
{
"name": "CVE-2023-32573",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32573"
},
{
"name": "CVE-2023-34969",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34969"
},
{
"name": "CVE-2023-45619",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45619"
},
{
"name": "CVE-2023-48364",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48364"
},
{
"name": "CVE-2023-3863",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3863"
},
{
"name": "CVE-2022-24834",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24834"
},
{
"name": "CVE-2023-30590",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30590"
},
{
"name": "CVE-2023-27538",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27538"
},
{
"name": "CVE-2023-36054",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36054"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2023-25690",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25690"
},
{
"name": "CVE-2022-1348",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1348"
},
{
"name": "CVE-2023-2861",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2861"
},
{
"name": "CVE-2023-25588",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25588"
},
{
"name": "CVE-2023-1255",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1255"
},
{
"name": "CVE-2023-3141",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3141"
},
{
"name": "CVE-2023-34872",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34872"
},
{
"name": "CVE-2023-30456",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30456"
},
{
"name": "CVE-2023-0567",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0567"
},
{
"name": "CVE-2024-23799",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23799"
},
{
"name": "CVE-2021-3638",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3638"
},
{
"name": "CVE-2023-34256",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34256"
},
{
"name": "CVE-2024-23796",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23796"
},
{
"name": "CVE-2022-4415",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4415"
},
{
"name": "CVE-2023-2455",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2455"
},
{
"name": "CVE-2023-3301",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3301"
},
{
"name": "CVE-2023-0662",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0662"
},
{
"name": "CVE-2023-3212",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3212"
},
{
"name": "CVE-2023-35001",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35001"
},
{
"name": "CVE-2022-44370",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44370"
},
{
"name": "CVE-2023-45620",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45620"
},
{
"name": "CVE-2023-34035",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34035"
},
{
"name": "CVE-2022-41860",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41860"
},
{
"name": "CVE-2024-23795",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23795"
},
{
"name": "CVE-2023-45615",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45615"
},
{
"name": "CVE-2022-29536",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29536"
},
{
"name": "CVE-2023-49692",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49692"
},
{
"name": "CVE-2022-23471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23471"
},
{
"name": "CVE-2020-1967",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1967"
},
{
"name": "CVE-2023-22745",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22745"
},
{
"name": "CVE-2022-3294",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3294"
},
{
"name": "CVE-2023-32006",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32006"
},
{
"name": "CVE-2023-24538",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24538"
},
{
"name": "CVE-2023-2975",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2975"
},
{
"name": "CVE-2023-45621",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45621"
},
{
"name": "CVE-2024-23804",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23804"
},
{
"name": "CVE-2022-41723",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41723"
},
{
"name": "CVE-2020-11896",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11896"
},
{
"name": "CVE-2023-2953",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2953"
},
{
"name": "CVE-2023-44373",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44373"
},
{
"name": "CVE-2023-41080",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41080"
},
{
"name": "CVE-2023-45626",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45626"
},
{
"name": "CVE-2023-1206",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1206"
},
{
"name": "CVE-2022-37436",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37436"
},
{
"name": "CVE-2024-23797",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23797"
},
{
"name": "CVE-2023-29402",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29402"
},
{
"name": "CVE-2023-31130",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31130"
},
{
"name": "CVE-2023-32233",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32233"
},
{
"name": "CVE-2023-38039",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38039"
},
{
"name": "CVE-2023-29409",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29409"
},
{
"name": "CVE-2023-0590",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0590"
},
{
"name": "CVE-2023-3446",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3446"
},
{
"name": "CVE-2023-1611",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1611"
},
{
"name": "CVE-2023-28486",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28486"
},
{
"name": "CVE-2024-24920",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24920"
},
{
"name": "CVE-2023-3268",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3268"
},
{
"name": "CVE-2023-0361",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0361"
},
{
"name": "CVE-2023-27537",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27537"
},
{
"name": "CVE-2023-45623",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45623"
},
{
"name": "CVE-2023-32002",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32002"
},
{
"name": "CVE-2022-4900",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4900"
},
{
"name": "CVE-2023-2124",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2124"
},
{
"name": "CVE-2022-48303",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48303"
},
{
"name": "CVE-2023-38545",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38545"
},
{
"name": "CVE-2023-28450",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28450"
}
],
"initial_release_date": "2024-02-13T00:00:00",
"last_revision_date": "2024-02-13T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0119",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-02-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Siemens\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance,\nune \u00e9l\u00e9vation de privil\u00e8ges et une ex\u00e9cution de code arbitraire \u00e0\ndistance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-000072 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-000072.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-602936 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-602936.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-647068 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-647068.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-943925 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-943925.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-753746 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-753746.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-806742 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-806742.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-580228 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-580228.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-716164 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-716164.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-797296 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-797296.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-108696 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-108696.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-871717 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-871717.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-516818 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-516818.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-017796 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-017796.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-543502 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-543502.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-665034 du 13 f\u00e9vrier 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-665034.html"
}
]
}
CERTFR-2026-AVI-0199
Vulnerability from certfr_avis - Published: 2026-02-24 - Updated: 2026-02-24
De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| VMware | Telco Cloud Platform | Telco Cloud Platform versions 4.x et 5.x sans le correctif de sécurité KB428241 | ||
| VMware | Tanzu Data Services | Tanzu Data Flow versions antérieures à 2.0.2 sur Tanzu Platform | ||
| VMware | Azure Spring Enterprise | Harbor Registry versions antérieures à 2.14.2 | ||
| VMware | Tanzu Data Intelligence | Tanzu pour MySQL versions 2.0.0 sur Kubernetes | ||
| VMware | Cloud Foundation | Cloud Foundation versions 9.x antérieures à 9.0.2.0 | ||
| VMware | Tanzu Kubernetes Runtime | App Metrics versions antérieures à2.3.3 | ||
| VMware | Tanzu Data Intelligence | Tanzu GemFire versions antérieures à 2.6.1 sur Kubernetes | ||
| VMware | Tanzu Kubernetes Runtime | CredHub Secrets Management pour Tanzu Platform versions antérieures à 1.6.8 | ||
| VMware | Tanzu Data Intelligence | Tanzu pour Valkey version 3.3.1 sur Kubernetes | ||
| VMware | Tanzu Operations Manager | Foundation Core pour Tanzu Platform versions antérieures à 3.2.4 | ||
| VMware | Aria Operations | Aria Operations versions 8.x antérieures à 8.18.6 | ||
| VMware | Tanzu Kubernetes Runtime | cf-mgmt pour Tanzu Platform versions antérieures à 1.0.108 | ||
| VMware | Tanzu Data Intelligence | Tanzu pour Valkey version 9.0.1 | ||
| VMware | Tanzu Kubernetes Runtime | Extended App Support pour Tanzu Platform versions antérieures à 1.0.15 | ||
| VMware | Tanzu Data Intelligence | Tanzu GemFire Management versions antérieures à 1.4.3 | ||
| VMware | Tanzu Kubernetes Runtime | NodeJS Buildpack versions antérieures à 1.8.77 | ||
| VMware | Tanzu Kubernetes Runtime | Cloud Native Buildpacks pour Tanzu Platform versions antérieures à 0.6.5 | ||
| VMware | Cloud Foundation | Cloud Foundation versions 4.x et 5.x sans le correctif de sécurité KB92148 | ||
| VMware | Tanzu Kubernetes Runtime | AI Services pour Tanzu Platform versions antérieures à 10.3.4 | ||
| VMware | Tanzu Kubernetes Runtime | Java Buildpack versions antérieures à 4.89.0 | ||
| VMware | Telco Cloud Infrastructure | Telco Cloud Infrastructure versions 2.x et 3.x sans le correctif de sécurité KB428241 | ||
| VMware | Tanzu Kubernetes Runtime | Elastic Application Runtime pour Tanzu Platform versions antérieures à 6.0.25+LTS-T, 10.2.8+LTS-T et 10.3.5 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Telco Cloud Platform versions 4.x et 5.x sans le correctif de s\u00e9curit\u00e9 KB428241",
"product": {
"name": "Telco Cloud Platform",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu Data Flow versions ant\u00e9rieures \u00e0 2.0.2 sur Tanzu Platform",
"product": {
"name": "Tanzu Data Services",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Harbor Registry versions ant\u00e9rieures \u00e0 2.14.2",
"product": {
"name": "Azure Spring Enterprise",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu pour MySQL versions 2.0.0 sur Kubernetes",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Cloud Foundation versions 9.x ant\u00e9rieures \u00e0 9.0.2.0",
"product": {
"name": "Cloud Foundation",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "App Metrics versions ant\u00e9rieures \u00e02.3.3",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu GemFire versions ant\u00e9rieures \u00e0 2.6.1 sur Kubernetes",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "CredHub Secrets Management pour Tanzu Platform versions ant\u00e9rieures \u00e0 1.6.8",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu pour Valkey version 3.3.1 sur Kubernetes",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Foundation Core pour Tanzu Platform versions ant\u00e9rieures \u00e0 3.2.4",
"product": {
"name": "Tanzu Operations Manager",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Aria Operations versions 8.x ant\u00e9rieures \u00e0 8.18.6",
"product": {
"name": "Aria Operations",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "cf-mgmt pour Tanzu Platform versions ant\u00e9rieures \u00e0 1.0.108",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu pour Valkey version 9.0.1",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Extended App Support pour Tanzu Platform versions ant\u00e9rieures \u00e0 1.0.15",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Tanzu GemFire Management versions ant\u00e9rieures \u00e0 1.4.3",
"product": {
"name": "Tanzu Data Intelligence",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "NodeJS Buildpack versions ant\u00e9rieures \u00e0 1.8.77",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Cloud Native Buildpacks pour Tanzu Platform versions ant\u00e9rieures \u00e0 0.6.5",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Cloud Foundation versions 4.x et 5.x sans le correctif de s\u00e9curit\u00e9 KB92148",
"product": {
"name": "Cloud Foundation",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "AI Services pour Tanzu Platform versions ant\u00e9rieures \u00e0 10.3.4",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Java Buildpack versions ant\u00e9rieures \u00e0 4.89.0",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Telco Cloud Infrastructure versions 2.x et 3.x sans le correctif de s\u00e9curit\u00e9 KB428241",
"product": {
"name": "Telco Cloud Infrastructure",
"vendor": {
"name": "VMware",
"scada": false
}
}
},
{
"description": "Elastic Application Runtime pour Tanzu Platform versions ant\u00e9rieures \u00e0 6.0.25+LTS-T, 10.2.8+LTS-T et 10.3.5",
"product": {
"name": "Tanzu Kubernetes Runtime",
"vendor": {
"name": "VMware",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-6395",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6395"
},
{
"name": "CVE-2022-1343",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1343"
},
{
"name": "CVE-2024-24790",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24790"
},
{
"name": "CVE-2025-47219",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47219"
},
{
"name": "CVE-2021-22898",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22898"
},
{
"name": "CVE-2021-3996",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3996"
},
{
"name": "CVE-2021-42384",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42384"
},
{
"name": "CVE-2023-0216",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0216"
},
{
"name": "CVE-2025-31651",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31651"
},
{
"name": "CVE-2024-20919",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20919"
},
{
"name": "CVE-2022-35252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35252"
},
{
"name": "CVE-2022-1473",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1473"
},
{
"name": "CVE-2023-21938",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21938"
},
{
"name": "CVE-2025-61730",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61730"
},
{
"name": "CVE-2022-32189",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32189"
},
{
"name": "CVE-2017-16544",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-16544"
},
{
"name": "CVE-2025-39987",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39987"
},
{
"name": "CVE-2021-42378",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42378"
},
{
"name": "CVE-2023-0401",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0401"
},
{
"name": "CVE-2025-21861",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21861"
},
{
"name": "CVE-2026-21933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21933"
},
{
"name": "CVE-2025-58183",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58183"
},
{
"name": "CVE-2023-21843",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21843"
},
{
"name": "CVE-2026-21932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21932"
},
{
"name": "CVE-2022-24450",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24450"
},
{
"name": "CVE-2025-66199",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66199"
},
{
"name": "CVE-2025-15282",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15282"
},
{
"name": "CVE-2024-21235",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21235"
},
{
"name": "CVE-2024-9681",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9681"
},
{
"name": "CVE-2021-37600",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37600"
},
{
"name": "CVE-2021-42382",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42382"
},
{
"name": "CVE-2020-10750",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10750"
},
{
"name": "CVE-2025-68973",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68973"
},
{
"name": "CVE-2022-30631",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30631"
},
{
"name": "CVE-2023-46218",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46218"
},
{
"name": "CVE-2025-40055",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40055"
},
{
"name": "CVE-2021-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42376"
},
{
"name": "CVE-2025-9714",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9714"
},
{
"name": "CVE-2026-22801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22801"
},
{
"name": "CVE-2025-39876",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39876"
},
{
"name": "CVE-2025-40029",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40029"
},
{
"name": "CVE-2025-38561",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38561"
},
{
"name": "CVE-2025-10148",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10148"
},
{
"name": "CVE-2023-28841",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28841"
},
{
"name": "CVE-2023-28840",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28840"
},
{
"name": "CVE-2025-40048",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40048"
},
{
"name": "CVE-2022-27191",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27191"
},
{
"name": "CVE-2025-40219",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40219"
},
{
"name": "CVE-2024-21144",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21144"
},
{
"name": "CVE-2025-40043",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40043"
},
{
"name": "CVE-2020-8169",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8169"
},
{
"name": "CVE-2021-41091",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41091"
},
{
"name": "CVE-2022-27781",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27781"
},
{
"name": "CVE-2021-22925",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22925"
},
{
"name": "CVE-2025-8556",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8556"
},
{
"name": "CVE-2026-21936",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21936"
},
{
"name": "CVE-2025-59775",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59775"
},
{
"name": "CVE-2026-21937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21937"
},
{
"name": "CVE-2025-39973",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39973"
},
{
"name": "CVE-2025-22872",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22872"
},
{
"name": "CVE-2025-8941",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8941"
},
{
"name": "CVE-2025-66614",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66614"
},
{
"name": "CVE-2018-1000517",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000517"
},
{
"name": "CVE-2025-15469",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15469"
},
{
"name": "CVE-2025-39943",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39943"
},
{
"name": "CVE-2025-39945",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39945"
},
{
"name": "CVE-2025-39883",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39883"
},
{
"name": "CVE-2023-29404",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29404"
},
{
"name": "CVE-2023-21954",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21954"
},
{
"name": "CVE-2022-4304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
},
{
"name": "CVE-2023-21939",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21939"
},
{
"name": "CVE-2022-0563",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0563"
},
{
"name": "CVE-2024-20926",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20926"
},
{
"name": "CVE-2025-0913",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0913"
},
{
"name": "CVE-2025-40019",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40019"
},
{
"name": "CVE-2025-40240",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40240"
},
{
"name": "CVE-2022-24921",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24921"
},
{
"name": "CVE-2022-32208",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32208"
},
{
"name": "CVE-2022-28327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28327"
},
{
"name": "CVE-2025-40081",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40081"
},
{
"name": "CVE-2025-47907",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47907"
},
{
"name": "CVE-2024-58011",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-58011"
},
{
"name": "CVE-2025-12084",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12084"
},
{
"name": "CVE-2025-40026",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40026"
},
{
"name": "CVE-2025-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40153"
},
{
"name": "CVE-2022-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1292"
},
{
"name": "CVE-2023-45283",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45283"
},
{
"name": "CVE-2025-40121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40121"
},
{
"name": "CVE-2026-1642",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1642"
},
{
"name": "CVE-2025-45582",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-45582"
},
{
"name": "CVE-2024-21068",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21068"
},
{
"name": "CVE-2025-55753",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55753"
},
{
"name": "CVE-2025-11468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11468"
},
{
"name": "CVE-2025-40204",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40204"
},
{
"name": "CVE-2025-40171",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40171"
},
{
"name": "CVE-2021-43816",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43816"
},
{
"name": "CVE-2023-45288",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
},
{
"name": "CVE-2025-6069",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6069"
},
{
"name": "CVE-2023-3817",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3817"
},
{
"name": "CVE-2025-39911",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39911"
},
{
"name": "CVE-2025-69419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69419"
},
{
"name": "CVE-2025-6052",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6052"
},
{
"name": "CVE-2022-41725",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41725"
},
{
"name": "CVE-2025-10543",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10543"
},
{
"name": "CVE-2025-40125",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40125"
},
{
"name": "CVE-2025-40349",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40349"
},
{
"name": "CVE-2025-6075",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6075"
},
{
"name": "CVE-2019-5481",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5481"
},
{
"name": "CVE-2025-26646",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26646"
},
{
"name": "CVE-2022-30635",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30635"
},
{
"name": "CVE-2022-29222",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29222"
},
{
"name": "CVE-2025-40187",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40187"
},
{
"name": "CVE-2025-58185",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58185"
},
{
"name": "CVE-2022-41715",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41715"
},
{
"name": "CVE-2024-21012",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21012"
},
{
"name": "CVE-2025-39913",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39913"
},
{
"name": "CVE-2022-32207",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32207"
},
{
"name": "CVE-2025-40092",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40092"
},
{
"name": "CVE-2022-41722",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41722"
},
{
"name": "CVE-2025-61731",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61731"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2025-39967",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39967"
},
{
"name": "CVE-2025-40115",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40115"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2021-42386",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42386"
},
{
"name": "CVE-2024-47561",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
},
{
"name": "CVE-2023-45285",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45285"
},
{
"name": "CVE-2025-13837",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13837"
},
{
"name": "CVE-2025-55752",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55752"
},
{
"name": "CVE-2024-24783",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24783"
},
{
"name": "CVE-2023-45284",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45284"
},
{
"name": "CVE-2025-39949",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39949"
},
{
"name": "CVE-2023-29403",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29403"
},
{
"name": "CVE-2022-27776",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27776"
},
{
"name": "CVE-2022-29190",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29190"
},
{
"name": "CVE-2025-40173",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40173"
},
{
"name": "CVE-2024-24791",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24791"
},
{
"name": "CVE-2024-20921",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20921"
},
{
"name": "CVE-2022-42916",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42916"
},
{
"name": "CVE-2022-28948",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28948"
},
{
"name": "CVE-2025-58767",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58767"
},
{
"name": "CVE-2024-56538",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56538"
},
{
"name": "CVE-2025-39923",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39923"
},
{
"name": "CVE-2023-4807",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4807"
},
{
"name": "CVE-2025-15367",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15367"
},
{
"name": "CVE-2022-31030",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31030"
},
{
"name": "CVE-2024-45341",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45341"
},
{
"name": "CVE-2018-20679",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20679"
},
{
"name": "CVE-2024-13176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-13176"
},
{
"name": "CVE-2025-39953",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39953"
},
{
"name": "CVE-2025-15467",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15467"
},
{
"name": "CVE-2023-2253",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2253"
},
{
"name": "CVE-2024-58251",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-58251"
},
{
"name": "CVE-2026-2006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2006"
},
{
"name": "CVE-2022-21624",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21624"
},
{
"name": "CVE-2023-28322",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28322"
},
{
"name": "CVE-2023-34462",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34462"
},
{
"name": "CVE-2025-40167",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40167"
},
{
"name": "CVE-2023-29405",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29405"
},
{
"name": "CVE-2021-38297",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38297"
},
{
"name": "CVE-2025-39969",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39969"
},
{
"name": "CVE-2025-4598",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4598"
},
{
"name": "CVE-2025-27144",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27144"
},
{
"name": "CVE-2017-15873",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15873"
},
{
"name": "CVE-2022-30629",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30629"
},
{
"name": "CVE-2025-40194",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40194"
},
{
"name": "CVE-2025-40245",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40245"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2023-5363",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5363"
},
{
"name": "CVE-2024-24557",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24557"
},
{
"name": "CVE-2023-45289",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45289"
},
{
"name": "CVE-2022-2068",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2068"
},
{
"name": "CVE-2023-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25193"
},
{
"name": "CVE-2025-40001",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40001"
},
{
"name": "CVE-2026-1485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1485"
},
{
"name": "CVE-2024-29025",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29025"
},
{
"name": "CVE-2023-0466",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0466"
},
{
"name": "CVE-2022-27782",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27782"
},
{
"name": "CVE-2022-32149",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32149"
},
{
"name": "CVE-2025-40035",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40035"
},
{
"name": "CVE-2023-0465",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0465"
},
{
"name": "CVE-2025-39988",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39988"
},
{
"name": "CVE-2026-22719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22719"
},
{
"name": "CVE-2022-32148",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32148"
},
{
"name": "CVE-2026-2005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2005"
},
{
"name": "CVE-2020-8177",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8177"
},
{
"name": "CVE-2023-22081",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22081"
},
{
"name": "CVE-2022-39399",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39399"
},
{
"name": "CVE-2022-4203",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4203"
},
{
"name": "CVE-2025-38584",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38584"
},
{
"name": "CVE-2021-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42374"
},
{
"name": "CVE-2025-50106",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50106"
},
{
"name": "CVE-2025-40233",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40233"
},
{
"name": "CVE-2025-40020",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40020"
},
{
"name": "CVE-2023-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
},
{
"name": "CVE-2025-40188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40188"
},
{
"name": "CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"name": "CVE-2023-22041",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22041"
},
{
"name": "CVE-2022-21626",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21626"
},
{
"name": "CVE-2025-66200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66200"
},
{
"name": "CVE-2025-58057",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58057"
},
{
"name": "CVE-2021-41771",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41771"
},
{
"name": "CVE-2025-8291",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8291"
},
{
"name": "CVE-2023-45290",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45290"
},
{
"name": "CVE-2023-28320",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28320"
},
{
"name": "CVE-2026-22795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22795"
},
{
"name": "CVE-2023-34231",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34231"
},
{
"name": "CVE-2026-0988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0988"
},
{
"name": "CVE-2025-61727",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61727"
},
{
"name": "CVE-2025-22866",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22866"
},
{
"name": "CVE-2026-21925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21925"
},
{
"name": "CVE-2024-26308",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26308"
},
{
"name": "CVE-2024-34158",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34158"
},
{
"name": "CVE-2025-30754",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30754"
},
{
"name": "CVE-2025-65637",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-65637"
},
{
"name": "CVE-2022-30630",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30630"
},
{
"name": "CVE-2026-0861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0861"
},
{
"name": "CVE-2023-47090",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47090"
},
{
"name": "CVE-2025-40049",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40049"
},
{
"name": "CVE-2025-47910",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47910"
},
{
"name": "CVE-2021-4160",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4160"
},
{
"name": "CVE-2025-40070",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40070"
},
{
"name": "CVE-2022-29946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29946"
},
{
"name": "CVE-2025-40106",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40106"
},
{
"name": "CVE-2023-0217",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0217"
},
{
"name": "CVE-2022-43552",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43552"
},
{
"name": "CVE-2024-51744",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51744"
},
{
"name": "CVE-2022-3786",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3786"
},
{
"name": "CVE-2021-3995",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3995"
},
{
"name": "CVE-2021-22947",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22947"
},
{
"name": "CVE-2025-40205",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40205"
},
{
"name": "CVE-2023-48795",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
},
{
"name": "CVE-2025-6965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
},
{
"name": "CVE-2023-28319",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28319"
},
{
"name": "CVE-2025-10966",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10966"
},
{
"name": "CVE-2021-22922",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22922"
},
{
"name": "CVE-2025-47906",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47906"
},
{
"name": "CVE-2022-22576",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22576"
},
{
"name": "CVE-2021-38561",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38561"
},
{
"name": "CVE-2025-59375",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59375"
},
{
"name": "CVE-2021-39293",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39293"
},
{
"name": "CVE-2025-31133",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31133"
},
{
"name": "CVE-2025-8194",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8194"
},
{
"name": "CVE-2024-29018",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29018"
},
{
"name": "CVE-2022-1705",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1705"
},
{
"name": "CVE-2024-11053",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11053"
},
{
"name": "CVE-2024-7264",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7264"
},
{
"name": "CVE-2025-40027",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40027"
},
{
"name": "CVE-2025-39885",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39885"
},
{
"name": "CVE-2022-3510",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3510"
},
{
"name": "CVE-2022-3509",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3509"
},
{
"name": "CVE-2021-22946",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22946"
},
{
"name": "CVE-2025-69421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69421"
},
{
"name": "CVE-2020-8284",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8284"
},
{
"name": "CVE-2023-23915",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23915"
},
{
"name": "CVE-2025-4517",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4517"
},
{
"name": "CVE-2025-58188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58188"
},
{
"name": "CVE-2025-30215",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30215"
},
{
"name": "CVE-2016-9843",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9843"
},
{
"name": "CVE-2023-39318",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39318"
},
{
"name": "CVE-2024-40635",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40635"
},
{
"name": "CVE-2022-41720",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41720"
},
{
"name": "CVE-2026-21948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21948"
},
{
"name": "CVE-2025-4674",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4674"
},
{
"name": "CVE-2022-41716",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41716"
},
{
"name": "CVE-2025-39970",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39970"
},
{
"name": "CVE-2021-3711",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3711"
},
{
"name": "CVE-2025-39994",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39994"
},
{
"name": "CVE-2025-52999",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52999"
},
{
"name": "CVE-2024-56433",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56433"
},
{
"name": "CVE-2023-0464",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0464"
},
{
"name": "CVE-2022-29526",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29526"
},
{
"name": "CVE-2025-40088",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40088"
},
{
"name": "CVE-2025-40220",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40220"
},
{
"name": "CVE-2021-3449",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3449"
},
{
"name": "CVE-2022-30633",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30633"
},
{
"name": "CVE-2023-22036",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22036"
},
{
"name": "CVE-2025-13151",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13151"
},
{
"name": "CVE-2025-22058",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22058"
},
{
"name": "CVE-2024-21634",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21634"
},
{
"name": "CVE-2022-28391",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28391"
},
{
"name": "CVE-2022-38749",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38749"
},
{
"name": "CVE-2025-40109",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40109"
},
{
"name": "CVE-2025-40006",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40006"
},
{
"name": "CVE-2022-21628",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21628"
},
{
"name": "CVE-2024-21011",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21011"
},
{
"name": "CVE-2025-6020",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6020"
},
{
"name": "CVE-2025-68161",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
},
{
"name": "CVE-2024-45336",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45336"
},
{
"name": "CVE-2025-52881",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52881"
},
{
"name": "CVE-2023-28842",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28842"
},
{
"name": "CVE-2025-7425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-7425"
},
{
"name": "CVE-2023-3978",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3978"
},
{
"name": "CVE-2022-26652",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26652"
},
{
"name": "CVE-2025-40011",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40011"
},
{
"name": "CVE-2024-5535",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5535"
},
{
"name": "CVE-2025-40085",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40085"
},
{
"name": "CVE-2023-42365",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42365"
},
{
"name": "CVE-2025-40231",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40231"
},
{
"name": "CVE-2025-22868",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22868"
},
{
"name": "CVE-2022-27775",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27775"
},
{
"name": "CVE-2026-22796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22796"
},
{
"name": "CVE-2021-42379",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42379"
},
{
"name": "CVE-2025-61724",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61724"
},
{
"name": "CVE-2024-5642",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5642"
},
{
"name": "CVE-2023-23914",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23914"
},
{
"name": "CVE-2025-23143",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23143"
},
{
"name": "CVE-2022-30632",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30632"
},
{
"name": "CVE-2025-65082",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-65082"
},
{
"name": "CVE-2024-47554",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47554"
},
{
"name": "CVE-2022-27774",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27774"
},
{
"name": "CVE-2023-25173",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25173"
},
{
"name": "CVE-2025-61732",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61732"
},
{
"name": "CVE-2025-61723",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61723"
},
{
"name": "CVE-2025-9232",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9232"
},
{
"name": "CVE-2023-29406",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29406"
},
{
"name": "CVE-2023-39319",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39319"
},
{
"name": "CVE-2026-21964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21964"
},
{
"name": "CVE-2025-21587",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21587"
},
{
"name": "CVE-2024-24785",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24785"
},
{
"name": "CVE-2025-46394",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46394"
},
{
"name": "CVE-2022-36109",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36109"
},
{
"name": "CVE-2025-68146",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68146"
},
{
"name": "CVE-2025-40183",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40183"
},
{
"name": "CVE-2021-42381",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42381"
},
{
"name": "CVE-2026-21441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21441"
},
{
"name": "CVE-2022-1962",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1962"
},
{
"name": "CVE-2024-45337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45337"
},
{
"name": "CVE-2024-21147",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21147"
},
{
"name": "CVE-2022-41717",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41717"
},
{
"name": "CVE-2025-39998",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39998"
},
{
"name": "CVE-2025-13836",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13836"
},
{
"name": "CVE-2023-39410",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39410"
},
{
"name": "CVE-2025-43857",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43857"
},
{
"name": "CVE-2023-28321",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28321"
},
{
"name": "CVE-2024-25710",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25710"
},
{
"name": "CVE-2025-40134",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40134"
},
{
"name": "CVE-2017-15874",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15874"
},
{
"name": "CVE-2024-7254",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
},
{
"name": "CVE-2025-61725",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61725"
},
{
"name": "CVE-2026-25210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25210"
},
{
"name": "CVE-2025-39968",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39968"
},
{
"name": "CVE-2023-24536",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24536"
},
{
"name": "CVE-2022-42915",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42915"
},
{
"name": "CVE-2022-32221",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32221"
},
{
"name": "CVE-2022-29458",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29458"
},
{
"name": "CVE-2025-55163",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55163"
},
{
"name": "CVE-2025-39986",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39986"
},
{
"name": "CVE-2025-39955",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39955"
},
{
"name": "CVE-2025-66293",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66293"
},
{
"name": "CVE-2022-24769",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24769"
},
{
"name": "CVE-2022-28131",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28131"
},
{
"name": "CVE-2025-12818",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12818"
},
{
"name": "CVE-2025-58098",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58098"
},
{
"name": "CVE-2025-32990",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32990"
},
{
"name": "CVE-2021-22897",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22897"
},
{
"name": "CVE-2025-40078",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40078"
},
{
"name": "CVE-2025-15366",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15366"
},
{
"name": "CVE-2022-24675",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24675"
},
{
"name": "CVE-2024-21140",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21140"
},
{
"name": "CVE-2025-40116",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40116"
},
{
"name": "CVE-2025-68249",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68249"
},
{
"name": "CVE-2026-0990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0990"
},
{
"name": "CVE-2025-39934",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39934"
},
{
"name": "CVE-2026-0865",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0865"
},
{
"name": "CVE-2024-21094",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21094"
},
{
"name": "CVE-2024-9143",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9143"
},
{
"name": "CVE-2022-23806",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23806"
},
{
"name": "CVE-2025-40179",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40179"
},
{
"name": "CVE-2025-40127",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40127"
},
{
"name": "CVE-2025-32989",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32989"
},
{
"name": "CVE-2025-39996",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39996"
},
{
"name": "CVE-2025-22874",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22874"
},
{
"name": "CVE-2026-22721",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22721"
},
{
"name": "CVE-2025-40053",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40053"
},
{
"name": "CVE-2026-24515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24515"
},
{
"name": "CVE-2025-39951",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39951"
},
{
"name": "CVE-2022-1271",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1271"
},
{
"name": "CVE-2025-40120",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40120"
},
{
"name": "CVE-2024-28085",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28085"
},
{
"name": "CVE-2024-41110",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41110"
},
{
"name": "CVE-2025-50059",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50059"
},
{
"name": "CVE-2022-48174",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48174"
},
{
"name": "CVE-2025-61594",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61594"
},
{
"name": "CVE-2023-21835",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21835"
},
{
"name": "CVE-2024-34156",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34156"
},
{
"name": "CVE-2022-2880",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2880"
},
{
"name": "CVE-2025-5025",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5025"
},
{
"name": "CVE-2023-21937",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21937"
},
{
"name": "CVE-2025-40243",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40243"
},
{
"name": "CVE-2022-23773",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23773"
},
{
"name": "CVE-2021-41089",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41089"
},
{
"name": "CVE-2023-24539",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24539"
},
{
"name": "CVE-2025-14104",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14104"
},
{
"name": "CVE-2023-6237",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6237"
},
{
"name": "CVE-2026-21968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21968"
},
{
"name": "CVE-2021-46848",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46848"
},
{
"name": "CVE-2025-30761",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30761"
},
{
"name": "CVE-2025-47912",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47912"
},
{
"name": "CVE-2023-25153",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25153"
},
{
"name": "CVE-2024-47535",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47535"
},
{
"name": "CVE-2022-4450",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4450"
},
{
"name": "CVE-2023-2650",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2650"
},
{
"name": "CVE-2025-68160",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68160"
},
{
"name": "CVE-2023-42364",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42364"
},
{
"name": "CVE-2025-54410",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54410"
},
{
"name": "CVE-2022-3996",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3996"
},
{
"name": "CVE-2022-2879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2879"
},
{
"name": "CVE-2025-40118",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40118"
},
{
"name": "CVE-2022-32205",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32205"
},
{
"name": "CVE-2023-27534",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27534"
},
{
"name": "CVE-2024-2398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2398"
},
{
"name": "CVE-2023-24532",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24532"
},
{
"name": "CVE-2025-52565",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52565"
},
{
"name": "CVE-2025-40021",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40021"
},
{
"name": "CVE-2025-67735",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67735"
},
{
"name": "CVE-2022-23772",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23772"
},
{
"name": "CVE-2025-61728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
},
{
"name": "CVE-2022-43551",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43551"
},
{
"name": "CVE-2022-42004",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42004"
},
{
"name": "CVE-2019-5747",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5747"
},
{
"name": "CVE-2025-58186",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58186"
},
{
"name": "CVE-2025-30698",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30698"
},
{
"name": "CVE-2025-40044",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40044"
},
{
"name": "CVE-2023-27533",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27533"
},
{
"name": "CVE-2025-40105",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40105"
},
{
"name": "CVE-2018-1000500",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000500"
},
{
"name": "CVE-2025-9086",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9086"
},
{
"name": "CVE-2026-26014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26014"
},
{
"name": "CVE-2021-41772",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41772"
},
{
"name": "CVE-2025-40112",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40112"
},
{
"name": "CVE-2024-27289",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27289"
},
{
"name": "CVE-2024-0727",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0727"
},
{
"name": "CVE-2025-58187",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58187"
},
{
"name": "CVE-2023-6129",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6129"
},
{
"name": "CVE-2025-39971",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39971"
},
{
"name": "CVE-2025-40154",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40154"
},
{
"name": "CVE-2025-13601",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13601"
},
{
"name": "CVE-2025-12817",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12817"
},
{
"name": "CVE-2025-4673",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4673"
},
{
"name": "CVE-2026-23949",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23949"
},
{
"name": "CVE-2021-42385",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42385"
},
{
"name": "CVE-2023-22045",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22045"
},
{
"name": "CVE-2023-29400",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29400"
},
{
"name": "CVE-2025-58056",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58056"
},
{
"name": "CVE-2025-22871",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22871"
},
{
"name": "CVE-2024-21138",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21138"
},
{
"name": "CVE-2025-32988",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32988"
},
{
"name": "CVE-2023-22049",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22049"
},
{
"name": "CVE-2024-24787",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24787"
},
{
"name": "CVE-2026-0915",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0915"
},
{
"name": "CVE-2025-15281",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15281"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2022-41854",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41854"
},
{
"name": "CVE-2022-41724",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41724"
},
{
"name": "CVE-2020-8908",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8908"
},
{
"name": "CVE-2024-6119",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6119"
},
{
"name": "CVE-2022-30634",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30634"
},
{
"name": "CVE-2025-40126",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40126"
},
{
"name": "CVE-2025-39972",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39972"
},
{
"name": "CVE-2025-24294",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24294"
},
{
"name": "CVE-2025-58181",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58181"
},
{
"name": "CVE-2021-42836",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42836"
},
{
"name": "CVE-2021-44716",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44716"
},
{
"name": "CVE-2025-47914",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47914"
},
{
"name": "CVE-2023-1255",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1255"
},
{
"name": "CVE-2025-69418",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69418"
},
{
"name": "CVE-2025-58058",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58058"
},
{
"name": "CVE-2025-22869",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22869"
},
{
"name": "CVE-2025-40200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40200"
},
{
"name": "CVE-2022-3358",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3358"
},
{
"name": "CVE-2025-38236",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38236"
},
{
"name": "CVE-2025-15468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15468"
},
{
"name": "CVE-2025-40124",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40124"
},
{
"name": "CVE-2025-39880",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39880"
},
{
"name": "CVE-2025-58189",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58189"
},
{
"name": "CVE-2025-6021",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6021"
},
{
"name": "CVE-2025-40094",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40094"
},
{
"name": "CVE-2022-2097",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2097"
},
{
"name": "CVE-2023-24540",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24540"
},
{
"name": "CVE-2024-4603",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4603"
},
{
"name": "CVE-2022-25857",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25857"
},
{
"name": "CVE-2022-38751",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38751"
},
{
"name": "CVE-2025-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25193"
},
{
"name": "CVE-2024-8096",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8096"
},
{
"name": "CVE-2026-21945",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21945"
},
{
"name": "CVE-2024-21145",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21145"
},
{
"name": "CVE-2022-32206",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32206"
},
{
"name": "CVE-2026-21941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21941"
},
{
"name": "CVE-2025-22870",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22870"
},
{
"name": "CVE-2025-40215",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40215"
},
{
"name": "CVE-2025-40111",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40111"
},
{
"name": "CVE-2021-3712",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3712"
},
{
"name": "CVE-2023-21968",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21968"
},
{
"name": "CVE-2025-40068",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40068"
},
{
"name": "CVE-2025-40042",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40042"
},
{
"name": "CVE-2025-32415",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32415"
},
{
"name": "CVE-2023-24537",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24537"
},
{
"name": "CVE-2025-5889",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5889"
},
{
"name": "CVE-2025-30749",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30749"
},
{
"name": "CVE-2026-22695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22695"
},
{
"name": "CVE-2026-23490",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23490"
},
{
"name": "CVE-2026-24733",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24733"
},
{
"name": "CVE-2026-0992",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0992"
},
{
"name": "CVE-2025-9230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
},
{
"name": "CVE-2026-21947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21947"
},
{
"name": "CVE-2025-66564",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66564"
},
{
"name": "CVE-2023-45287",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45287"
},
{
"name": "CVE-2024-4741",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4741"
},
{
"name": "CVE-2019-5482",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5482"
},
{
"name": "CVE-2025-48924",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48924"
},
{
"name": "CVE-2023-21930",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21930"
},
{
"name": "CVE-2022-38752",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38752"
},
{
"name": "CVE-2021-22926",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22926"
},
{
"name": "CVE-2025-8916",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8916"
},
{
"name": "CVE-2025-32414",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32414"
},
{
"name": "CVE-2025-39937",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39937"
},
{
"name": "CVE-2025-11187",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11187"
},
{
"name": "CVE-2024-20918",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20918"
},
{
"name": "CVE-2025-40060",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40060"
},
{
"name": "CVE-2026-2003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2003"
},
{
"name": "CVE-2019-5443",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5443"
},
{
"name": "CVE-2022-38750",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38750"
},
{
"name": "CVE-2022-30580",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30580"
},
{
"name": "CVE-2022-23471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23471"
},
{
"name": "CVE-2020-1967",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1967"
},
{
"name": "CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"name": "CVE-2025-60876",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60876"
},
{
"name": "CVE-2023-24531",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24531"
},
{
"name": "CVE-2021-23840",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23840"
},
{
"name": "CVE-2023-24538",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24538"
},
{
"name": "CVE-2023-2975",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2975"
},
{
"name": "CVE-2022-42003",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42003"
},
{
"name": "CVE-2021-44717",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44717"
},
{
"name": "CVE-2025-11065",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11065"
},
{
"name": "CVE-2022-3602",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3602"
},
{
"name": "CVE-2026-1484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1484"
},
{
"name": "CVE-2025-4947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4947"
},
{
"name": "CVE-2025-40178",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40178"
},
{
"name": "CVE-2022-29804",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29804"
},
{
"name": "CVE-2025-39869",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39869"
},
{
"name": "CVE-2025-0725",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0725"
},
{
"name": "CVE-2023-2976",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2976"
},
{
"name": "CVE-2025-39985",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39985"
},
{
"name": "CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"name": "CVE-2022-1434",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1434"
},
{
"name": "CVE-2021-22923",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22923"
},
{
"name": "CVE-2022-41723",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41723"
},
{
"name": "CVE-2025-59464",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59464"
},
{
"name": "CVE-2023-22006",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22006"
},
{
"name": "CVE-2019-5435",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5435"
},
{
"name": "CVE-2022-1471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1471"
},
{
"name": "CVE-2025-8058",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8058"
},
{
"name": "CVE-2026-1489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1489"
},
{
"name": "CVE-2023-39323",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39323"
},
{
"name": "CVE-2023-29402",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29402"
},
{
"name": "CVE-2026-2004",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2004"
},
{
"name": "CVE-2026-0672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0672"
},
{
"name": "CVE-2025-8732",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8732"
},
{
"name": "CVE-2023-39326",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39326"
},
{
"name": "CVE-2024-21085",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21085"
},
{
"name": "CVE-2021-43565",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43565"
},
{
"name": "CVE-2025-21502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21502"
},
{
"name": "CVE-2023-29409",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29409"
},
{
"name": "CVE-2022-23648",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23648"
},
{
"name": "CVE-2021-23841",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23841"
},
{
"name": "CVE-2025-30204",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30204"
},
{
"name": "CVE-2023-39325",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39325"
},
{
"name": "CVE-2025-5914",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5914"
},
{
"name": "CVE-2026-22720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22720"
},
{
"name": "CVE-2024-20945",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20945"
},
{
"name": "CVE-2023-42363",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42363"
},
{
"name": "CVE-2023-24534",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24534"
},
{
"name": "CVE-2024-21131",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21131"
},
{
"name": "CVE-2025-39980",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39980"
},
{
"name": "CVE-2024-21210",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21210"
},
{
"name": "CVE-2023-3446",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3446"
},
{
"name": "CVE-2024-2511",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
},
{
"name": "CVE-2025-53057",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53057"
},
{
"name": "CVE-2024-24786",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24786"
},
{
"name": "CVE-2022-3171",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3171"
},
{
"name": "CVE-2019-1551",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1551"
},
{
"name": "CVE-2025-40346",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40346"
},
{
"name": "CVE-2023-21967",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21967"
},
{
"name": "CVE-2024-34155",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34155"
},
{
"name": "CVE-2022-21619",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21619"
},
{
"name": "CVE-2025-40030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40030"
},
{
"name": "CVE-2025-40244",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40244"
},
{
"name": "CVE-2025-39995",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39995"
},
{
"name": "CVE-2025-68119",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68119"
},
{
"name": "CVE-2022-21698",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21698"
},
{
"name": "CVE-2025-53066",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53066"
},
{
"name": "CVE-2025-22873",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22873"
},
{
"name": "CVE-2023-5678",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5678"
},
{
"name": "CVE-2024-24784",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24784"
},
{
"name": "CVE-2022-27780",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27780"
},
{
"name": "CVE-2025-39907",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39907"
},
{
"name": "CVE-2023-42366",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42366"
},
{
"name": "CVE-2024-21217",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21217"
},
{
"name": "CVE-2025-0167",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0167"
},
{
"name": "CVE-2026-25547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
},
{
"name": "CVE-2025-69420",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69420"
},
{
"name": "CVE-2024-20952",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20952"
},
{
"name": "CVE-2025-40140",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40140"
},
{
"name": "CVE-2024-24789",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24789"
},
{
"name": "CVE-2025-40223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40223"
},
{
"name": "CVE-2022-27664",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27664"
},
{
"name": "CVE-2026-1225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1225"
},
{
"name": "CVE-2024-53114",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53114"
},
{
"name": "CVE-2024-27304",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27304"
},
{
"name": "CVE-2026-22703",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22703"
},
{
"name": "CVE-2026-0989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0989"
},
{
"name": "CVE-2025-61729",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
},
{
"name": "CVE-2025-39873",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39873"
},
{
"name": "CVE-2024-21208",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21208"
},
{
"name": "CVE-2023-23916",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23916"
},
{
"name": "CVE-2022-29189",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29189"
},
{
"name": "CVE-2025-38248",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38248"
},
{
"name": "CVE-2025-40351",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40351"
},
{
"name": "CVE-2025-40087",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40087"
},
{
"name": "CVE-2026-25646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25646"
}
],
"initial_release_date": "2026-02-24T00:00:00",
"last_revision_date": "2026-02-24T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0199",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits VMware. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
"vendor_advisories": [
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37012",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37012"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37001",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37001"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37013",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37013"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37003",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37003"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37023",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37023"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37017",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37017"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37006",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37006"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37024",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37024"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 36997",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36997"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37004",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37004"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 36947",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37018",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37018"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37005",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37005"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37008",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37008"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37007",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37007"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37020",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37020"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 36998",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36998"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37002",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37002"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37021",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37021"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37022",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37022"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37016",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37016"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37019",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37019"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37010",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37010"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37009",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37009"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37000",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37000"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37011",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37011"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37015",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37015"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 37014",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37014"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 VMware 36999",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36999"
}
]
}
Title
OpenSSL代码问题漏洞
Description
OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。
OpenSSL 1.1.1d版本、1.1.1e版本和1.1.1f版本中的'SSL_check_chain()'函数存在代码问题漏洞。远程攻击者可利用该漏洞导致服务器或客户端应用程序崩溃。
Severity
中
Patch Name
OpenSSL代码问题漏洞的补丁
Patch Description
OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。
OpenSSL 1.1.1d版本、1.1.1e版本和1.1.1f版本中的'SSL_check_chain()'函数存在代码问题漏洞。远程攻击者可利用该漏洞导致服务器或客户端应用程序崩溃。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.openssl.org/news/secadv/20200421.txt
Reference
https://nvd.nist.gov/vuln/detail/CVE-2020-1967
Impacted products
| Name | ['Openssl Openssl 1.1.1d', 'Openssl Openssl 1.1.1e', 'Openssl Openssl 1.1.1f'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2020-1967"
}
},
"description": "OpenSSL\u662fOpenSSL\u56e2\u961f\u7684\u4e00\u4e2a\u5f00\u6e90\u7684\u80fd\u591f\u5b9e\u73b0\u5b89\u5168\u5957\u63a5\u5c42\uff08SSLv2/v3\uff09\u548c\u5b89\u5168\u4f20\u8f93\u5c42\uff08TLSv1\uff09\u534f\u8bae\u7684\u901a\u7528\u52a0\u5bc6\u5e93\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u591a\u79cd\u52a0\u5bc6\u7b97\u6cd5\uff0c\u5305\u62ec\u5bf9\u79f0\u5bc6\u7801\u3001\u54c8\u5e0c\u7b97\u6cd5\u3001\u5b89\u5168\u6563\u5217\u7b97\u6cd5\u7b49\u3002\n\nOpenSSL 1.1.1d\u7248\u672c\u30011.1.1e\u7248\u672c\u548c1.1.1f\u7248\u672c\u4e2d\u7684\u0027SSL_check_chain()\u0027\u51fd\u6570\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u670d\u52a1\u5668\u6216\u5ba2\u6237\u7aef\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.openssl.org/news/secadv/20200421.txt",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2021-28731",
"openTime": "2021-04-16",
"patchDescription": "OpenSSL\u662fOpenSSL\u56e2\u961f\u7684\u4e00\u4e2a\u5f00\u6e90\u7684\u80fd\u591f\u5b9e\u73b0\u5b89\u5168\u5957\u63a5\u5c42\uff08SSLv2/v3\uff09\u548c\u5b89\u5168\u4f20\u8f93\u5c42\uff08TLSv1\uff09\u534f\u8bae\u7684\u901a\u7528\u52a0\u5bc6\u5e93\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u591a\u79cd\u52a0\u5bc6\u7b97\u6cd5\uff0c\u5305\u62ec\u5bf9\u79f0\u5bc6\u7801\u3001\u54c8\u5e0c\u7b97\u6cd5\u3001\u5b89\u5168\u6563\u5217\u7b97\u6cd5\u7b49\u3002\r\n\r\nOpenSSL 1.1.1d\u7248\u672c\u30011.1.1e\u7248\u672c\u548c1.1.1f\u7248\u672c\u4e2d\u7684\u0027SSL_check_chain()\u0027\u51fd\u6570\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u670d\u52a1\u5668\u6216\u5ba2\u6237\u7aef\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "OpenSSL\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"Openssl Openssl 1.1.1d",
"Openssl Openssl 1.1.1e",
"Openssl Openssl 1.1.1f"
]
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-1967",
"serverity": "\u4e2d",
"submitTime": "2020-04-22",
"title": "OpenSSL\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}
FKIE_CVE-2020-1967
Vulnerability from fkie_nvd - Published: 2020-04-21 14:15 - Updated: 2024-11-21 05:11
Severity
Summary
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
References
| URL | Tags | ||
|---|---|---|---|
| openssl-security@openssl.org | http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html | Mailing List, Third Party Advisory | |
| openssl-security@openssl.org | http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html | Mailing List, Third Party Advisory | |
| openssl-security@openssl.org | http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html | Third Party Advisory, VDB Entry | |
| openssl-security@openssl.org | http://seclists.org/fulldisclosure/2020/May/5 | Mailing List, Third Party Advisory | |
| openssl-security@openssl.org | http://www.openwall.com/lists/oss-security/2020/04/22/2 | Mailing List, Third Party Advisory | |
| openssl-security@openssl.org | https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1 | ||
| openssl-security@openssl.org | https://github.com/irsl/CVE-2020-1967 | Exploit, Third Party Advisory | |
| openssl-security@openssl.org | https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440 | Third Party Advisory | |
| openssl-security@openssl.org | https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E | ||
| openssl-security@openssl.org | https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E | ||
| openssl-security@openssl.org | https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E | ||
| openssl-security@openssl.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/ | ||
| openssl-security@openssl.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/ | ||
| openssl-security@openssl.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/ | ||
| openssl-security@openssl.org | https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc | Patch, Third Party Advisory | |
| openssl-security@openssl.org | https://security.gentoo.org/glsa/202004-10 | Third Party Advisory | |
| openssl-security@openssl.org | https://security.netapp.com/advisory/ntap-20200424-0003/ | Third Party Advisory | |
| openssl-security@openssl.org | https://security.netapp.com/advisory/ntap-20200717-0004/ | Third Party Advisory | |
| openssl-security@openssl.org | https://www.debian.org/security/2020/dsa-4661 | Third Party Advisory | |
| openssl-security@openssl.org | https://www.openssl.org/news/secadv/20200421.txt | Vendor Advisory | |
| openssl-security@openssl.org | https://www.oracle.com//security-alerts/cpujul2021.html | Patch, Third Party Advisory | |
| openssl-security@openssl.org | https://www.oracle.com/security-alerts/cpuApr2021.html | Patch, Third Party Advisory | |
| openssl-security@openssl.org | https://www.oracle.com/security-alerts/cpujan2021.html | Patch, Third Party Advisory | |
| openssl-security@openssl.org | https://www.oracle.com/security-alerts/cpujul2020.html | Third Party Advisory | |
| openssl-security@openssl.org | https://www.oracle.com/security-alerts/cpuoct2020.html | Patch, Third Party Advisory | |
| openssl-security@openssl.org | https://www.oracle.com/security-alerts/cpuoct2021.html | Patch, Third Party Advisory | |
| openssl-security@openssl.org | https://www.synology.com/security/advisory/Synology_SA_20_05 | Third Party Advisory | |
| openssl-security@openssl.org | https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL | Third Party Advisory | |
| openssl-security@openssl.org | https://www.tenable.com/security/tns-2020-03 | Third Party Advisory | |
| openssl-security@openssl.org | https://www.tenable.com/security/tns-2020-04 | Third Party Advisory | |
| openssl-security@openssl.org | https://www.tenable.com/security/tns-2020-11 | Third Party Advisory | |
| openssl-security@openssl.org | https://www.tenable.com/security/tns-2021-10 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2020/May/5 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2020/04/22/2 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/irsl/CVE-2020-1967 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202004-10 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20200424-0003/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20200717-0004/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2020/dsa-4661 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.openssl.org/news/secadv/20200421.txt | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.oracle.com//security-alerts/cpujul2021.html | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.oracle.com/security-alerts/cpuApr2021.html | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.oracle.com/security-alerts/cpujan2021.html | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.oracle.com/security-alerts/cpujul2020.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.oracle.com/security-alerts/cpuoct2020.html | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.oracle.com/security-alerts/cpuoct2021.html | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.synology.com/security/advisory/Synology_SA_20_05 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.tenable.com/security/tns-2020-03 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.tenable.com/security/tns-2020-04 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.tenable.com/security/tns-2020-11 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.tenable.com/security/tns-2021-10 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openssl | openssl | * | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| freebsd | freebsd | 12.1 | |
| fedoraproject | fedora | 30 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| oracle | application_server | 12.1.3 | |
| oracle | enterprise_manager_base_platform | 13.4.0.0 | |
| oracle | enterprise_manager_for_storage_management | 13.3.0.0 | |
| oracle | enterprise_manager_for_storage_management | 13.4.0.0 | |
| oracle | enterprise_manager_ops_center | 12.4.0 | |
| oracle | http_server | 12.2.1.4.0 | |
| oracle | jd_edwards_world_security | a9.4 | |
| oracle | mysql | * | |
| oracle | mysql | * | |
| oracle | mysql | * | |
| oracle | mysql_connectors | * | |
| oracle | mysql_enterprise_monitor | * | |
| oracle | mysql_enterprise_monitor | * | |
| oracle | mysql_workbench | * | |
| oracle | peoplesoft_enterprise_peopletools | 8.56 | |
| oracle | peoplesoft_enterprise_peopletools | 8.57 | |
| oracle | peoplesoft_enterprise_peopletools | 8.58 | |
| oracle | peoplesoft_enterprise_peopletools | 8.59 | |
| netapp | active_iq_unified_manager | * | |
| netapp | active_iq_unified_manager | * | |
| netapp | e-series_performance_analyzer | - | |
| netapp | oncommand_insight | - | |
| netapp | oncommand_workflow_automation | - | |
| netapp | smi-s_provider | - | |
| netapp | snapcenter | - | |
| netapp | steelstore_cloud_integrated_storage | - | |
| broadcom | fabric_operating_system | - | |
| opensuse | leap | 15.1 | |
| opensuse | leap | 15.2 | |
| jdedwards | enterpriseone | * | |
| tenable | log_correlation_engine | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"matchCriteriaId": "90907017-473C-48CA-9441-DAFAF5F81049",
"versionEndIncluding": "1.1.1f",
"versionStartIncluding": "1.1.1d",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:*",
"matchCriteriaId": "BD730B6A-F123-4685-ACB3-4F20AAAB77F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:application_server:12.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CDD7E6AC-A613-4938-91D1-402DA2038875",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D26F3E23-F1A9-45E7-9E5F-0C0A24EE3783",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F87918FE-62C0-4DC5-8894-847DFB5B7E5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61516569-C48F-4362-B334-8CA10EDB0EC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "37209C6F-EF99-4D21-9608-B3A06D283D24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD04BEE5-E9A8-4584-A68C-0195CE9C402C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1CAD50-749F-4ADB-A046-BF3585677A58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6C5EC81-F74A-4280-A041-EC5EE36D0919",
"versionEndIncluding": "5.6.48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1A68EF8-15AA-42A7-9734-6F9470EB35CD",
"versionEndIncluding": "5.7.30",
"versionStartIncluding": "5.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0E1A3769-E443-4511-B349-B5304F5E6EBD",
"versionEndIncluding": "8.0.20",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F198EB3-A3AB-42EA-BF3A-D8BB4D9210EE",
"versionEndIncluding": "8.0.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9A3BBE71-CA00-4F54-9210-FC7572C87CFB",
"versionEndIncluding": "4.0.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73573516-EDA0-4176-A3ED-2F7006C87F8E",
"versionEndIncluding": "8.0.20",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9E07B577-50FE-43B4-8AAD-4C267A494A36",
"versionEndIncluding": "8.0.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*",
"matchCriteriaId": "D0A735B4-4F3C-416B-8C08-9CB21BAD2889",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*",
"matchCriteriaId": "7E1E416B-920B-49A0-9523-382898C2979D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
"matchCriteriaId": "D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*",
"matchCriteriaId": "C8AF00C6-B97F-414D-A8DF-057E6BFD8597",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
"matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
"versionStartIncluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*",
"matchCriteriaId": "0CB28AF5-5AF0-4475-A7B6-12E1795FFDCB",
"versionStartIncluding": "9.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
"matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4BB0FDCF-3750-44C6-AC5C-0CC2AAD14093",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BDFB1169-41A0-4A86-8E4F-FDA9730B1E94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*",
"matchCriteriaId": "046FB51E-B768-44D3-AEB5-D857145CA840",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jdedwards:enterpriseone:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0E4475E9-FF6F-4B94-8989-D8E2EB69F782",
"versionEndExcluding": "9.2.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4ACF85D6-6B45-43DA-9C01-F0208186F014",
"versionEndExcluding": "6.0.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)."
},
{
"lang": "es",
"value": "Las aplicaciones de Servidor o Cliente que llaman a la funci\u00f3n SSL_check_chain() durante o despu\u00e9s del protocolo de enlace de TLS versi\u00f3n 1.3, puede bloquear debido a una desreferencia del puntero NULL como resultado de un manejo incorrecto de la extensi\u00f3n TLS \"signature_algorithms_cert\". El bloqueo ocurre si se recibe un algoritmo de firma no comprobada o ni reconocido del peer. Esto podr\u00eda ser explotado por un peer malicioso en un ataque de Denegaci\u00f3n de Servicio. OpenSSL versiones 1.1.1d, 1.1.1e y 1.1.1f est\u00e1n afectadas por este problema. Este problema no afectaba a OpenSSL versiones anteriores a la versi\u00f3n 1.1.1d. Corregido en OpenSSL versi\u00f3n 1.1.1g (Afectado en la versi\u00f3n 1.1.1d-1.1.1f)."
}
],
"id": "CVE-2020-1967",
"lastModified": "2024-11-21T05:11:45.023",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-04-21T14:15:11.287",
"references": [
{
"source": "openssl-security@openssl.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2020/May/5"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2020/04/22/2"
},
{
"source": "openssl-security@openssl.org",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/irsl/CVE-2020-1967"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440"
},
{
"source": "openssl-security@openssl.org",
"url": "https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E"
},
{
"source": "openssl-security@openssl.org",
"url": "https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E"
},
{
"source": "openssl-security@openssl.org",
"url": "https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E"
},
{
"source": "openssl-security@openssl.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/"
},
{
"source": "openssl-security@openssl.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/"
},
{
"source": "openssl-security@openssl.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202004-10"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200424-0003/"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200717-0004/"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4661"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.openssl.org/news/secadv/20200421.txt"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2020-03"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2020-04"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"source": "openssl-security@openssl.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2020/May/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2020/04/22/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/irsl/CVE-2020-1967"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202004-10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200424-0003/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200717-0004/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4661"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.openssl.org/news/secadv/20200421.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2020-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2020-04"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2021-10"
}
],
"sourceIdentifier": "openssl-security@openssl.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-JQ65-29V4-4X35
Vulnerability from github – Published: 2021-08-25 20:45 – Updated: 2021-08-19 21:21
VLAI
Summary
Null pointer deference in openssl-src
Details
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "openssl-src"
},
"ranges": [
{
"events": [
{
"introduced": "111.6.0"
},
{
"fixed": "111.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-1967"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T21:21:21Z",
"nvd_published_at": "2020-04-21T14:15:00Z",
"severity": "HIGH"
},
"details": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).",
"id": "GHSA-jq65-29v4-4x35",
"modified": "2021-08-19T21:21:21Z",
"published": "2021-08-25T20:45:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1967"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2020-04"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2020-03"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"type": "WEB",
"url": "https://www.openssl.org/news/secadv/20200421.txt"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4661"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200717-0004"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200424-0003"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202004-10"
},
{
"type": "WEB",
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2020-0015.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440"
},
{
"type": "WEB",
"url": "https://github.com/irsl/CVE-2020-1967"
},
{
"type": "WEB",
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/May/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/04/22/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Null pointer deference in openssl-src "
}
GSD-2020-1967
Vulnerability from gsd - Updated: 2023-12-13 01:21Details
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-1967",
"description": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).",
"id": "GSD-2020-1967",
"references": [
"https://www.suse.com/security/cve/CVE-2020-1967.html",
"https://www.debian.org/security/2020/dsa-4661",
"https://security.archlinux.org/CVE-2020-1967",
"https://packetstormsecurity.com/files/cve/CVE-2020-1967"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-1967"
],
"details": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).",
"id": "GSD-2020-1967",
"modified": "2023-12-13T01:21:57.664057Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "openssl-security@openssl.org",
"DATE_PUBLIC": "2020-04-21",
"ID": "CVE-2020-1967",
"STATE": "PUBLIC",
"TITLE": "Segmentation fault in SSL_check_chain"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenSSL",
"version": {
"version_data": [
{
"version_value": "Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)"
}
]
}
}
]
},
"vendor_name": "OpenSSL"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Bernd Edlinger"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)."
}
]
},
"impact": [
{
"lang": "eng",
"url": "https://www.openssl.org/policies/secpolicy.html#High",
"value": "High"
}
],
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "NULL pointer dereference"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FreeBSD-SA-20:11",
"refsource": "FREEBSD",
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc"
},
{
"name": "DSA-4661",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4661"
},
{
"name": "[oss-security] 20200422 [CVE-2020-1967] OpenSSL 1.1.1d+ Segmentation fault in SSL_check_chain",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2020/04/22/2"
},
{
"name": "[tomcat-dev] 20200422 Time for Tomcat Native 1.2.24?",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200422 Re: Time for Tomcat Native 1.2.24?",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200423 Re: Time for Tomcat Native 1.2.24?",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "GLSA-202004-10",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202004-10"
},
{
"name": "FEDORA-2020-fcc91a28e8",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/"
},
{
"name": "FEDORA-2020-da2d1ef2d7",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/"
},
{
"name": "20200501 CVE-2020-1967: proving sigalg != NULL",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2020/May/5"
},
{
"name": "FEDORA-2020-d7b29838f6",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/"
},
{
"name": "openSUSE-SU-2020:0933",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html"
},
{
"name": "openSUSE-SU-2020:0945",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"name": "https://www.tenable.com/security/tns-2020-03",
"refsource": "CONFIRM",
"url": "https://www.tenable.com/security/tns-2020-03"
},
{
"name": "https://www.openssl.org/news/secadv/20200421.txt",
"refsource": "CONFIRM",
"url": "https://www.openssl.org/news/secadv/20200421.txt"
},
{
"name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1",
"refsource": "CONFIRM",
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1"
},
{
"name": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440",
"refsource": "CONFIRM",
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200424-0003/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200424-0003/"
},
{
"name": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL",
"refsource": "CONFIRM",
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL"
},
{
"name": "https://github.com/irsl/CVE-2020-1967",
"refsource": "MISC",
"url": "https://github.com/irsl/CVE-2020-1967"
},
{
"name": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html"
},
{
"name": "https://www.synology.com/security/advisory/Synology_SA_20_05",
"refsource": "CONFIRM",
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05"
},
{
"name": "https://www.tenable.com/security/tns-2020-04",
"refsource": "CONFIRM",
"url": "https://www.tenable.com/security/tns-2020-04"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200717-0004/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200717-0004/"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"name": "https://www.tenable.com/security/tns-2020-11",
"refsource": "CONFIRM",
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"name": "https://www.tenable.com/security/tns-2021-10",
"refsource": "CONFIRM",
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"name": "https://www.oracle.com//security-alerts/cpujul2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=1.1.1d \u003c=1.1.1f",
"affected_versions": "All versions starting from 1.1.1d up to 1.1.1f",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-476",
"CWE-937"
],
"date": "2021-12-10",
"description": "Server or client applications that call the `SSL_check_chain()` function during or after a TLS handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the `signature_algorithms_cert` TLS extension.",
"fixed_versions": [
"1.1.1g"
],
"identifier": "CVE-2020-1967",
"identifiers": [
"CVE-2020-1967"
],
"not_impacted": "All versions before 1.1.1d, all versions after 1.1.1f",
"package_slug": "conan/openssl",
"pubdate": "2020-04-21",
"solution": "Upgrade to version 1.1.1g or above.",
"title": "NULL Pointer Dereference",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-1967",
"http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1",
"https://www.openssl.org/news/secadv/20200421.txt"
],
"uuid": "717b48de-d2c7-4a49-8c10-2f8bc50e39dc"
},
{
"affected_range": "(,8.0.20]",
"affected_versions": "All versions up to 8.0.20",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-476",
"CWE-937"
],
"date": "2021-12-10",
"description": "Server or client applications that call the `SSL_check_chain()` function during or after a TLS handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the `signature_algorithms_cert` TLS extension.",
"fixed_versions": [],
"identifier": "CVE-2020-1967",
"identifiers": [
"CVE-2020-1967"
],
"not_impacted": "",
"package_slug": "maven/mysql-connector-java",
"pubdate": "2020-04-21",
"solution": "Unfortunately, there is no solution available yet.",
"title": "NULL Pointer Dereference",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-1967",
"http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1",
"https://www.openssl.org/news/secadv/20200421.txt"
],
"uuid": "d61b74ab-1887-4af9-8fdc-daafed5df3d9"
},
{
"affected_range": "\u003c=8.0.20",
"affected_versions": "All versions up to 8.0.20",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-476",
"CWE-937"
],
"date": "2021-12-10",
"description": "Server or client applications that call the `SSL_check_chain()` function during or after a TLS handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the `signature_algorithms_cert` TLS extension.",
"fixed_versions": [
"8.0.21"
],
"identifier": "CVE-2020-1967",
"identifiers": [
"CVE-2020-1967"
],
"not_impacted": "All versions after 8.0.20",
"package_slug": "pypi/mysql-connector-python",
"pubdate": "2020-04-21",
"solution": "Upgrade to version 8.0.21 or above.",
"title": "NULL Pointer Dereference",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-1967",
"http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1",
"https://www.openssl.org/news/secadv/20200421.txt"
],
"uuid": "29560bc1-18a4-4350-9eaf-b6a85bcce039"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.1.1f",
"versionStartIncluding": "1.1.1d",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:oracle:application_server:12.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "5.6.48",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "5.7.30",
"versionStartIncluding": "5.7.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.20",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.20",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.0.12",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.20",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.0.21",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionStartIncluding": "7.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*",
"cpe_name": [],
"versionStartIncluding": "9.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:jdedwards:enterpriseone:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.2.5.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0.9",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "openssl-security@openssl.org",
"ID": "CVE-2020-1967"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1",
"refsource": "CONFIRM",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1"
},
{
"name": "https://www.openssl.org/news/secadv/20200421.txt",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://www.openssl.org/news/secadv/20200421.txt"
},
{
"name": "FreeBSD-SA-20:11",
"refsource": "FREEBSD",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc"
},
{
"name": "DSA-4661",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4661"
},
{
"name": "[oss-security] 20200422 [CVE-2020-1967] OpenSSL 1.1.1d+ Segmentation fault in SSL_check_chain",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2020/04/22/2"
},
{
"name": "[tomcat-dev] 20200422 Time for Tomcat Native 1.2.24?",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200422 Re: Time for Tomcat Native 1.2.24?",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440"
},
{
"name": "[tomcat-dev] 20200423 Re: Time for Tomcat Native 1.2.24?",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "GLSA-202004-10",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202004-10"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200424-0003/",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200424-0003/"
},
{
"name": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL"
},
{
"name": "FEDORA-2020-fcc91a28e8",
"refsource": "FEDORA",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/"
},
{
"name": "https://www.tenable.com/security/tns-2020-03",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2020-03"
},
{
"name": "FEDORA-2020-da2d1ef2d7",
"refsource": "FEDORA",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/"
},
{
"name": "https://github.com/irsl/CVE-2020-1967",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/irsl/CVE-2020-1967"
},
{
"name": "20200501 CVE-2020-1967: proving sigalg != NULL",
"refsource": "FULLDISC",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2020/May/5"
},
{
"name": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html"
},
{
"name": "FEDORA-2020-d7b29838f6",
"refsource": "FEDORA",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/"
},
{
"name": "https://www.synology.com/security/advisory/Synology_SA_20_05",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_20_05"
},
{
"name": "https://www.tenable.com/security/tns-2020-04",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2020-04"
},
{
"name": "openSUSE-SU-2020:0933",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html"
},
{
"name": "openSUSE-SU-2020:0945",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpujul2020.html",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200717-0004/",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20200717-0004/"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"name": "https://www.tenable.com/security/tns-2020-11",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2020-11"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2021.html",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"name": "https://www.tenable.com/security/tns-2021-10",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"name": "N/A",
"refsource": "N/A",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2021-12-10T17:11Z",
"publishedDate": "2020-04-21T14:15Z"
}
}
}
ICSA-24-046-02
Vulnerability from csaf_cisa - Published: 2024-02-13 00:00 - Updated: 2024-02-13 00:00Summary
Siemens SIDIS Prime
Notes
Summary: SIDIS Prime before V4.0.400 is affected by multiple vulnerabilities in the components OPC UA and OpenSSL, that could allow an unauthenticated attacker with access to the network where SIDIS Prime is installed to reuse OPC UA client credentials, create a denial of service condition of the SIDIS Prime OPC UA client, or create a denial of service condition of the SIDIS Prime TLS service.
Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use: Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer: This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors: Multiple
Countries/areas deployed: Worldwide
Company headquarters location: Germany
Recommended Practices: CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices: Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices: Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices: When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
7.4 (High)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SIDIS Prime
Siemens / SIDIS Prime
|
<V4.0.400 |
Mitigation
Vendor Fix
|
7.5 (High)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SIDIS Prime
Siemens / SIDIS Prime
|
<V4.0.400 |
Vendor Fix
|
5.9 (Medium)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SIDIS Prime
Siemens / SIDIS Prime
|
<V4.0.400 |
Vendor Fix
|
7.5 (High)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SIDIS Prime
Siemens / SIDIS Prime
|
<V4.0.400 |
Vendor Fix
|
7.5 (High)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
SIDIS Prime
Siemens / SIDIS Prime
|
<V4.0.400 |
Vendor Fix
|
References
12 references
| URL | Category |
|---|---|
| https://cert-portal.siemens.com/productcert/csaf/… | self |
| https://cert-portal.siemens.com/productcert/html/… | self |
| https://cert-portal.siemens.com/productcert/pdf/s… | self |
| https://cert-portal.siemens.com/productcert/txt/s… | self |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | self |
| https://www.cisa.gov/news-events/ics-advisories/i… | self |
| https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-… | external |
| https://www.cisa.gov/resources-tools/resources/ic… | external |
| https://www.cisa.gov/topics/industrial-control-systems | external |
| https://us-cert.cisa.gov/sites/default/files/reco… | external |
| https://www.cisa.gov/sites/default/files/publicat… | external |
| https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B | external |
Acknowledgments
Siemens ProductCERT
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting these vulnerabilities to CISA."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "SIDIS Prime before V4.0.400 is affected by multiple vulnerabilities in the components OPC UA and OpenSSL, that could allow an unauthenticated attacker with access to the network where SIDIS Prime is installed to reuse OPC UA client credentials, create a denial of service condition of the SIDIS Prime OPC UA client, or create a denial of service condition of the SIDIS Prime TLS service.\n\nSiemens has released a new version of SIDIS Prime and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-108696.json"
},
{
"category": "self",
"summary": "SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-108696.html"
},
{
"category": "self",
"summary": "SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-108696.pdf"
},
{
"category": "self",
"summary": "SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-108696.txt"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-24-046-02 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-046-02.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-24-046-02 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-02"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens SIDIS Prime",
"tracking": {
"current_release_date": "2024-02-13T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-24-046-02",
"initial_release_date": "2024-02-13T00:00:00.000000Z",
"revision_history": [
{
"date": "2024-02-13T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV4.0.400",
"product": {
"name": "SIDIS Prime",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SIDIS Prime"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-19135",
"cwe": {
"id": "CWE-330",
"name": "Use of Insufficiently Random Values"
},
"notes": [
{
"category": "summary",
"text": "In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "CVE-2019-19135: Enable encrypted communication between the affected product (OPC UA client) and the OPC UA server(s)",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update to V4.0.400 or later version",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2019-19135"
},
{
"cve": "CVE-2020-1967",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0.400 or later version",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2020-1967"
},
{
"cve": "CVE-2020-1971",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL\u0027s s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL\u0027s parser will accept and hence trigger this attack.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0.400 or later version",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2020-1971"
},
{
"cve": "CVE-2022-0778",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The BN_mod_sqrt() function in openSSL, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0.400 or later version",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-0778"
},
{
"cve": "CVE-2022-29862",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V4.0.400 or later version",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-29862"
}
]
}
OPENSUSE-SU-2020:0933-1
Vulnerability from csaf_opensuse - Published: 2020-07-06 12:56 - Updated: 2020-07-06 12:56Summary
Security update for rust, rust-cbindgen
Severity
Moderate
Notes
Title of the patch: Security update for rust, rust-cbindgen
Description of the patch: This update for rust, rust-cbindgen fixes the following issues:
rust was updated for use by Firefox 76ESR.
- Fixed miscompilations with rustc 1.43 that lead to LTO failures (bsc#1173202)
Update to version 1.43.1
- Updated openssl-src to 1.1.1g for CVE-2020-1967.
- Fixed the stabilization of AVX-512 features.
- Fixed `cargo package --list` not working with unpublished dependencies.
Update to version 1.43.0
+ Language:
- Fixed using binary operations with `&{number}` (e.g. `&1.0`)
not having the type inferred correctly.
- Attributes such as `#[cfg()]` can now be used on `if`
expressions.
- Syntax only changes:
* Allow `type Foo: Ord` syntactically.
* Fuse associated and extern items up to defaultness.
* Syntactically allow `self` in all `fn` contexts.
* Merge `fn` syntax + cleanup item parsing.
* `item` macro fragments can be interpolated into `trait`s,
`impl`s, and `extern` blocks.
For example, you may now write:
```rust
macro_rules! mac_trait {
($i:item) => {
trait T { $i }
}
}
mac_trait! {
fn foo() {}
}
```
* These are still rejected *semantically*, so you will likely
receive an error but these changes can be seen and parsed by
macros and conditional compilation.
+ Compiler
- You can now pass multiple lint flags to rustc to override the previous flags.
For example; `rustc -D unused -A unused-variables` denies
everything in the `unused` lint group except `unused-variables`
which is explicitly allowed. However, passing
`rustc -A unused-variables -D unused` denies everything in
the `unused` lint group **including** `unused-variables` since
the allow flag is specified before the deny flag (and therefore
overridden).
- rustc will now prefer your system MinGW libraries over its
bundled libraries if they are available on `windows-gnu`.
- rustc now buffers errors/warnings printed in JSON.
Libraries:
- `Arc<[T; N]>`, `Box<[T; N]>`, and `Rc<[T; N]>`, now implement
`TryFrom<Arc<[T]>>`,`TryFrom<Box<[T]>>`, and `TryFrom<Rc<[T]>>`
respectively.
**Note** These conversions are only available when `N` is
`0..=32`.
- You can now use associated constants on floats and integers
directly, rather than having to import the module.
e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
- `u8::is_ascii` is now `const`.
- `String` now implements `AsMut<str>`.
- Added the `primitive` module to `std` and `core`.
This module reexports Rust's primitive types. This is mainly
useful in macros where you want avoid these types being shadowed.
- Relaxed some of the trait bounds on `HashMap` and `HashSet`.
- `string::FromUtf8Error` now implements `Clone + Eq`.
+ Stabilized APIs
- `Once::is_completed`
- `f32::LOG10_2`
- `f32::LOG2_10`
- `f64::LOG10_2`
- `f64::LOG2_10`
- `iter::once_with`
+ Cargo
- You can now set config `[profile]`s in your `.cargo/config`,
or through your environment.
- Cargo will now set `CARGO_BIN_EXE_<name>` pointing to a
binary's executable path when running integration tests or
benchmarks.
`<name>` is the name of your binary as-is e.g. If you wanted
the executable path for a binary named `my-program`you would
use `env!('CARGO_BIN_EXE_my-program')`.
+ Misc
- Certain checks in the `const_err` lint were deemed unrelated
to const evaluation, and have been moved to the
`unconditional_panic` and `arithmetic_overflow` lints.
+ Compatibility Notes
- Having trailing syntax in the `assert!` macro is now a hard
error. This has been a warning since 1.36.0.
- Fixed `Self` not having the correctly inferred type. This
incorrectly led to some instances being accepted, and now
correctly emits a hard error.
Update to version 1.42.0:
+ Language
- You can now use the slice pattern syntax with subslices.
- You can now use #[repr(transparent)] on univariant enums. Meaning
that you can create an enum that has the exact layout and ABI of
the type it contains.
- There are some syntax-only changes:
* default is syntactically allowed before items in trait
definitions.
* Items in impls (i.e. consts, types, and fns) may syntactically
leave out their bodies in favor of ;.
* Bounds on associated types in impls are now syntactically
allowed (e.g. type Foo: Ord;).
* ... (the C-variadic type) may occur syntactically directly
as the type of any function parameter.
These are still rejected semantically, so you will likely receive
an error but these changes can be seen and parsed by procedural
macros and conditional compilation.
+ Compiler
- Added tier 2 support for armv7a-none-eabi.
- Added tier 2 support for riscv64gc-unknown-linux-gnu.
- Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
unwrap_err} now produce panic messages pointing to the location
where they were called, rather than core's internals.
Refer to Rust's platform support page for more information on
Rust's tiered platform support.
+ Libraries
- iter::Empty<T> now implements Send and Sync for any T.
- Pin::{map_unchecked, map_unchecked_mut} no longer require the
return type to implement Sized.
- io::Cursor now derives PartialEq and Eq.
- Layout::new is now const.
- Added Standard Library support for riscv64gc-unknown-linux-gnu.
+ Stabilized APIs
- CondVar::wait_while
- CondVar::wait_timeout_while
- DebugMap::key
- DebugMap::value
- ManuallyDrop::take
- matches!
- ptr::slice_from_raw_parts_mut
- ptr::slice_from_raw_parts
+ Cargo
- You no longer need to include extern crate proc_macro; to be
able to use proc_macro; in the 2018 edition.
+ Compatibility Notes
- Error::description has been deprecated, and its use will now
produce a warning. It's recommended to use Display/to_string
instead.
Update to version 1.41.1:
- Always check types of static items
- Always check lifetime bounds of `Copy` impls
- Fix miscompilation in callers of `Layout::repeat`
Update to version 1.41.0:
+ Language
- You can now pass type parameters to foreign items when implementing
traits. E.g. You can now write `impl<T> From<Foo> for Vec<T> {}`.
- You can now arbitrarily nest receiver types in the `self` position. E.g. you can
now write `fn foo(self: Box<Box<Self>>) {}`. Previously only `Self`, `&Self`,
`&mut Self`, `Arc<Self>`, `Rc<Self>`, and `Box<Self>` were allowed.
- You can now use any valid identifier in a `format_args` macro.
Previously identifiers starting with an underscore were not allowed.
- Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
enum variants. These are still rejected semantically, but
can be seen and parsed by procedural macros and conditional compilation.
+ Compiler
- Rustc will now warn if you have unused loop `'label`s.
- Removed support for the `i686-unknown-dragonfly` target.
- Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
- You can now pass an arguments file passing the `@path` syntax
to rustc. Note that the format differs somewhat from what is
found in other tooling; please see the documentation for
more information.
- You can now provide `--extern` flag without a path, indicating that it is
available from the search path or specified with an `-L` flag.
Refer to Rust's [platform support page][forge-platform-support] for more
information on Rust's tiered platform support.
+ Libraries
- The `core::panic` module is now stable. It was already stable
through `std`.
- `NonZero*` numerics now implement `From<NonZero*>` if it's a smaller integer
width. E.g. `NonZeroU16` now implements `From<NonZeroU8>`.
- `MaybeUninit<T>` now implements `fmt::Debug`.
+ Stabilized APIs
- `Result::map_or`
- `Result::map_or_else`
- `std::rc::Weak::weak_count`
- `std::rc::Weak::strong_count`
- `std::sync::Weak::weak_count`
- `std::sync::Weak::strong_count`
+ Cargo
- Cargo will now document all the private items for binary crates
by default.
- `cargo-install` will now reinstall the package if it detects that it is out
of date.
- Cargo.lock now uses a more git friendly format that should help to reduce
merge conflicts.
- You can now override specific dependencies's build settings. E.g.
`[profile.dev.package.image] opt-level = 2` sets the `image` crate's
optimisation level to `2` for debug builds. You can also use
`[profile.<profile>.build-override]` to override build scripts and
their dependencies.
+ Misc
- You can now specify `edition` in documentation code blocks to compile the block
for that edition. E.g. `edition2018` tells rustdoc that the code sample
should be compiled the 2018 edition of Rust.
- You can now provide custom themes to rustdoc with `--theme`, and check the
current theme with `--check-theme`.
- You can use `#[cfg(doc)]` to compile an item when building documentation.
+ Compatibility Notes
- As previously announced 1.41.0 will be the last tier 1 release for 32-bit
Apple targets. This means that the source code is still
available to build, but the targets are no longer being tested and release
binaries for those platforms will no longer be distributed by the Rust project.
Please refer to the linked blog post for more information.
- Bump version of libssh2 for SLE15; we now need a version with
libssh2_userauth_publickey_frommemory(), which appeared in libssh2
1.6.0.
Update to version 1.40.0
+ Language
- You can now use tuple `struct`s and tuple `enum` variant's constructors in
`const` contexts. e.g.
pub struct Point(i32, i32);
const ORIGIN: Point = {
let constructor = Point;
constructor(0, 0)
};
- You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
indicate that there may be variants or fields added in the future.
For example this requires adding a wild-card branch (`_ => {}`) to any match
statements on a non-exhaustive `enum`.
- You can now use function-like procedural macros in `extern` blocks and in
type positions. e.g. `type Generated = macro!();`
- Function-like and attribute procedural macros can now emit
`macro_rules!` items, so you can now have your macros generate macros.
- The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
`#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
+ Compiler
- Added tier 3 support\* for the
`thumbv7neon-unknown-linux-musleabihf` target.
- Added tier 3 support for the
`aarch64-unknown-none-softfloat` target.
- Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
`mips64el-unknown-linux-muslabi64` targets.
+ Libraries
- The `is_power_of_two` method on unsigned numeric types is now a `const` function.
+ Stabilized APIs
- BTreeMap::get_key_value
- HashMap::get_key_value
- Option::as_deref_mut
- Option::as_deref
- Option::flatten
- UdpSocket::peer_addr
- f32::to_be_bytes
- f32::to_le_bytes
- f32::to_ne_bytes
- f64::to_be_bytes
- f64::to_le_bytes
- f64::to_ne_bytes
- f32::from_be_bytes
- f32::from_le_bytes
- f32::from_ne_bytes
- f64::from_be_bytes
- f64::from_le_bytes
- f64::from_ne_bytes
- mem::take
- slice::repeat
- todo!
+ Cargo
- Cargo will now always display warnings, rather than only on
fresh builds.
- Feature flags (except `--all-features`) passed to a virtual workspace will
now produce an error. Previously these flags were ignored.
- You can now publish `dev-dependencies` without including
a `version`.
+ Misc
- You can now specify the `#[cfg(doctest)]` attribute to include an item only
when running documentation tests with `rustdoc`.
+ Compatibility Notes
- As previously announced, any previous NLL warnings in the 2015 edition are
now hard errors.
- The `include!` macro will now warn if it failed to include the
entire file. The `include!` macro unintentionally only includes the
first _expression_ in a file, and this can be unintuitive. This will become
either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
- Using `#[inline]` on function prototypes and consts now emits a warning under
`unused_attribute` lint. Using `#[inline]` anywhere else inside traits
or `extern` blocks now correctly emits a hard error.
Update to version 1.39.0
+ Language
- You can now create async functions and blocks with async fn,
async move {}, and async {} respectively, and you can now call
.await on async expressions.
- You can now use certain attributes on function, closure, and
function pointer parameters.
- You can now take shared references to bind-by-move patterns in
the if guards of match arms.
+ Compiler
- Added tier 3 support for the i686-unknown-uefi target.
- Added tier 3 support for the sparc64-unknown-openbsd target.
- rustc will now trim code snippets in diagnostics to fit in your
terminal.
- You can now pass --show-output argument to test binaries to
print the output of successful tests.
+ For more details:
https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Switch to bundled version of libgit2 for now. libgit2-sys seems
to expect using the bundled variant, which just seems to point
to a snapshot of the master branch and doesn't match any released
libgit2 (bsc#1154817).
See: https://github.com/rust-lang/rust/issues/63476 and
https://github.com/rust-lang/git2-rs/issues/458 for details.
Update to version 1.38.0
+ Language
- The `#[global_allocator]` attribute can now be used in submodules.
- The `#[deprecated]` attribute can now be used on macros.
+ Compiler
- Added pipelined compilation support to `rustc`. This will
improve compilation times in some cases.
+ Libraries
- `ascii::EscapeDefault` now implements `Clone` and `Display`.
- Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
available at the same path as the trait. (e.g. The `Clone` derive macro
is available at `std::clone::Clone`). This also makes all built-in macros
available in `std`/`core` root. e.g. `std::include_bytes!`.
- `str::Chars` now implements `Debug`.
- `slice::{concat, connect, join}` now accepts `&[T]` in addition to `&T`.
- `*const T` and `*mut T` now implement `marker::Unpin`.
- `Arc<[T]>` and `Rc<[T]>` now implement `FromIterator<T>`.
- Added euclidean remainder and division operations (`div_euclid`,
`rem_euclid`) to all numeric primitives. Additionally `checked`,
`overflowing`, and `wrapping` versions are available for all
integer primitives.
- `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
`PartialEq`.
- `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
+ Stabilized APIs
- `<*const T>::cast`
- `<*mut T>::cast`
- `Duration::as_secs_f32`
- `Duration::as_secs_f64`
- `Duration::div_f32`
- `Duration::div_f64`
- `Duration::from_secs_f32`
- `Duration::from_secs_f64`
- `Duration::mul_f32`
- `Duration::mul_f64`
- `any::type_name`
+ Cargo
- Added pipelined compilation support to `cargo`.
- You can now pass the `--features` option multiple times to enable
multiple features.
+ Misc
- `rustc` will now warn about some incorrect uses of
`mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.
Update to version 1.37.0
+ Language
- #[must_use] will now warn if the type is contained in a tuple,
Box, or an array and unused.
- You can now use the `cfg` and `cfg_attr` attributes on
generic parameters.
- You can now use enum variants through type alias. e.g. You can
write the following:
```
type MyOption = Option<u8>;
fn increment_or_zero(x: MyOption) -> u8 {
match x {
MyOption::Some(y) => y + 1,
MyOption::None => 0,
}
}
```
- You can now use `_` as an identifier for consts. e.g. You can write
`const _: u32 = 5;`.
- You can now use `#[repr(align(X)]` on enums.
- The `?` Kleene macro operator is now available in the
2015 edition.
+ Compiler
- You can now enable Profile-Guided Optimization with the `-C profile-generate`
and `-C profile-use` flags. For more information on how to use profile
guided optimization, please refer to the rustc book.
- The `rust-lldb` wrapper script should now work again.
+ Libraries
- `mem::MaybeUninit<T>` is now ABI-compatible with `T`.
+ Stabilized APIs
- BufReader::buffer
- BufWriter::buffer
- Cell::from_mut
- Cell<[T]>::as_slice_of_cells
- Cell<slice>::as_slice_of_cells
- DoubleEndedIterator::nth_back
- Option::xor
- Wrapping::reverse_bits
- i128::reverse_bits
- i16::reverse_bits
- i32::reverse_bits
- i64::reverse_bits
- i8::reverse_bits
- isize::reverse_bits
- slice::copy_within
- u128::reverse_bits
- u16::reverse_bits
- u32::reverse_bits
- u64::reverse_bits
- u8::reverse_bits
- usize::reverse_bits
+ Cargo
- Cargo.lock files are now included by default when publishing executable crates
with executables.
- You can now specify `default-run='foo'` in `[package]` to specify the
default executable to use for `cargo run`.
- cargo-vendor is now provided as a sub-command of cargo
+ Compatibility Notes
- Using `...` for inclusive range patterns will now warn by default.
Please transition your code to using the `..=` syntax for inclusive
ranges instead.
- Using a trait object without the `dyn` will now warn by default.
Please transition your code to use `dyn Trait` for trait objects instead.
Crab(String),
Lobster(String),
Person(String),
let state = Creature::Crab('Ferris');
if let Creature::Crab(name) | Creature::Person(name) = state {
println!('This creature's name is: {}', name);
}
unsafe { foo() }
pub fn new(x: i32, y: i32) -> Self {
Self(x, y)
}
pub fn is_origin(&self) -> bool {
match self {
Self(0, 0) => true,
_ => false,
}
}
Self: PartialOrd<Self> // can write `Self` instead of `List<T>`
Nil,
Cons(T, Box<Self>) // likewise here
fn test(&self) { println!('one'); } //~ ERROR duplicate definitions with name `test`
fn test(&self) { println!('two'); }
* Basic procedural macros allowing custom `#[derive]`, aka 'macros 1.1', are
stable. This allows popular code-generating crates like Serde and Diesel to
work ergonomically. [RFC 1681].
* [Tuple structs may be empty. Unary and empty tuple structs may be instantiated
with curly braces][36868]. Part of [RFC 1506].
* [A number of minor changes to name resolution have been activated][37127].
They add up to more consistent semantics, allowing for future evolution of
Rust macros. Specified in [RFC 1560], see its section on ['changes'] for
details of what is different. The breaking changes here have been transitioned
through the [`legacy_imports`] lint since 1.14, with no known regressions.
* [In `macro_rules`, `path` fragments can now be parsed as type parameter
bounds][38279]
* [`?Sized` can be used in `where` clauses][37791]
* [There is now a limit on the size of monomorphized types and it can be
modified with the `#![type_size_limit]` crate attribute, similarly to
the `#![recursion_limit]` attribute][37789]
* [On Windows, the compiler will apply dllimport attributes when linking to
extern functions][37973]. Additional attributes and flags can control which
library kind is linked and its name. [RFC 1717].
* [Rust-ABI symbols are no longer exported from cdylibs][38117]
* [The `--test` flag works with procedural macro crates][38107]
* [Fix `extern 'aapcs' fn` ABI][37814]
* [The `-C no-stack-check` flag is deprecated][37636]. It does nothing.
* [The `format!` expander recognizes incorrect `printf` and shell-style
formatting directives and suggests the correct format][37613].
* [Only report one error for all unused imports in an import list][37456]
* [Avoid unnecessary `mk_ty` calls in `Ty::super_fold_with`][37705]
* [Avoid more unnecessary `mk_ty` calls in `Ty::super_fold_with`][37979]
* [Don't clone in `UnificationTable::probe`][37848]
* [Remove `scope_auxiliary` to cut RSS by 10%][37764]
* [Use small vectors in type walker][37760]
* [Macro expansion performance was improved][37701]
* [Change `HirVec<P<T>>` to `HirVec<T>` in `hir::Expr`][37642]
* [Replace FNV with a faster hash function][37229]
https://raw.githubusercontent.com/rust-lang/rust/master/RELEASES.md
rust-cbindgen is shipped in version 0.14.1.
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames: openSUSE-2020-933
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cargo-doc-1.43.1-lp151.5.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-cbindgen-0.14.1-lp151.8.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-src-1.43.1-lp151.5.13.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
10 references
| URL | Category |
|---|---|
| https://www.suse.com/support/security/rating/ | external |
| https://ftp.suse.com/pub/projects/security/csaf/o… | self |
| https://lists.opensuse.org/archives/list/security… | self |
| https://lists.opensuse.org/archives/list/security… | self |
| https://bugzilla.suse.com/1115645 | self |
| https://bugzilla.suse.com/1154817 | self |
| https://bugzilla.suse.com/1173202 | self |
| https://www.suse.com/security/cve/CVE-2020-1967/ | self |
| https://www.suse.com/security/cve/CVE-2020-1967 | external |
| https://bugzilla.suse.com/1169407 | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for rust, rust-cbindgen",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for rust, rust-cbindgen fixes the following issues:\n\nrust was updated for use by Firefox 76ESR.\n\n- Fixed miscompilations with rustc 1.43 that lead to LTO failures (bsc#1173202)\n\nUpdate to version 1.43.1\n\n- Updated openssl-src to 1.1.1g for CVE-2020-1967.\n- Fixed the stabilization of AVX-512 features.\n- Fixed `cargo package --list` not working with unpublished dependencies.\n\nUpdate to version 1.43.0\n\n+ Language:\n\n- Fixed using binary operations with `\u0026{number}` (e.g. `\u00261.0`) \n not having the type inferred correctly.\n- Attributes such as `#[cfg()]` can now be used on `if` \n expressions.\n- Syntax only changes:\n * Allow `type Foo: Ord` syntactically.\n * Fuse associated and extern items up to defaultness.\n * Syntactically allow `self` in all `fn` contexts.\n * Merge `fn` syntax + cleanup item parsing.\n * `item` macro fragments can be interpolated into `trait`s, \n `impl`s, and `extern` blocks.\n For example, you may now write:\n ```rust \n macro_rules! mac_trait {\n ($i:item) =\u003e {\n trait T { $i }\n }\n }\n mac_trait! {\n fn foo() {}\n }\n ```\n * These are still rejected *semantically*, so you will likely \n receive an error but these changes can be seen and parsed by \n macros and conditional compilation.\n\n+ Compiler\n\n- You can now pass multiple lint flags to rustc to override the previous flags. \n\n For example; `rustc -D unused -A unused-variables` denies\n everything in the `unused` lint group except `unused-variables` \n which is explicitly allowed. However, passing \n `rustc -A unused-variables -D unused` denies everything in \n the `unused` lint group **including** `unused-variables` since \n the allow flag is specified before the deny flag (and therefore \n overridden).\n- rustc will now prefer your system MinGW libraries over its \n bundled libraries if they are available on `windows-gnu`.\n- rustc now buffers errors/warnings printed in JSON.\n\nLibraries:\n\n- `Arc\u003c[T; N]\u003e`, `Box\u003c[T; N]\u003e`, and `Rc\u003c[T; N]\u003e`, now implement \n `TryFrom\u003cArc\u003c[T]\u003e\u003e`,`TryFrom\u003cBox\u003c[T]\u003e\u003e`, and `TryFrom\u003cRc\u003c[T]\u003e\u003e`\n respectively.\n **Note** These conversions are only available when `N` is \n `0..=32`.\n- You can now use associated constants on floats and integers \n directly, rather than having to import the module.\n e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.\n- `u8::is_ascii` is now `const`.\n- `String` now implements `AsMut\u003cstr\u003e`.\n- Added the `primitive` module to `std` and `core`. \n This module reexports Rust\u0027s primitive types. This is mainly \n useful in macros where you want avoid these types being shadowed.\n- Relaxed some of the trait bounds on `HashMap` and `HashSet`.\n- `string::FromUtf8Error` now implements `Clone + Eq`.\n\n+ Stabilized APIs\n\n- `Once::is_completed`\n- `f32::LOG10_2`\n- `f32::LOG2_10`\n- `f64::LOG10_2`\n- `f64::LOG2_10`\n- `iter::once_with`\n\n+ Cargo\n\n - You can now set config `[profile]`s in your `.cargo/config`, \n or through your environment.\n - Cargo will now set `CARGO_BIN_EXE_\u003cname\u003e` pointing to a \n binary\u0027s executable path when running integration tests or \n benchmarks.\n `\u003cname\u003e` is the name of your binary as-is e.g. If you wanted \n the executable path for a binary named `my-program`you would \n use `env!(\u0027CARGO_BIN_EXE_my-program\u0027)`.\n\n+ Misc\n\n - Certain checks in the `const_err` lint were deemed unrelated \n to const evaluation, and have been moved to the \n `unconditional_panic` and `arithmetic_overflow` lints.\n\n+ Compatibility Notes\n\n - Having trailing syntax in the `assert!` macro is now a hard \n error. This has been a warning since 1.36.0.\n - Fixed `Self` not having the correctly inferred type. This \n incorrectly led to some instances being accepted, and now \n correctly emits a hard error.\n\nUpdate to version 1.42.0:\n\n+ Language\n\n - You can now use the slice pattern syntax with subslices.\n - You can now use #[repr(transparent)] on univariant enums. Meaning\n that you can create an enum that has the exact layout and ABI of\n the type it contains.\n - There are some syntax-only changes:\n * default is syntactically allowed before items in trait\n definitions.\n * Items in impls (i.e. consts, types, and fns) may syntactically\n leave out their bodies in favor of ;.\n * Bounds on associated types in impls are now syntactically\n allowed (e.g. type Foo: Ord;).\n * ... (the C-variadic type) may occur syntactically directly\n as the type of any function parameter.\n These are still rejected semantically, so you will likely receive\n an error but these changes can be seen and parsed by procedural\n macros and conditional compilation.\n\n+ Compiler\n\n - Added tier 2 support for armv7a-none-eabi.\n - Added tier 2 support for riscv64gc-unknown-linux-gnu.\n - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,\n unwrap_err} now produce panic messages pointing to the location\n where they were called, rather than core\u0027s internals.\n Refer to Rust\u0027s platform support page for more information on\n Rust\u0027s tiered platform support.\n\n+ Libraries\n\n - iter::Empty\u003cT\u003e now implements Send and Sync for any T.\n - Pin::{map_unchecked, map_unchecked_mut} no longer require the\n return type to implement Sized.\n - io::Cursor now derives PartialEq and Eq.\n - Layout::new is now const.\n - Added Standard Library support for riscv64gc-unknown-linux-gnu.\n\n+ Stabilized APIs\n\n - CondVar::wait_while\n - CondVar::wait_timeout_while\n - DebugMap::key\n - DebugMap::value\n - ManuallyDrop::take\n - matches!\n - ptr::slice_from_raw_parts_mut\n - ptr::slice_from_raw_parts\n\n+ Cargo\n\n - You no longer need to include extern crate proc_macro; to be\n able to use proc_macro; in the 2018 edition.\n\n+ Compatibility Notes\n\n - Error::description has been deprecated, and its use will now\n produce a warning. It\u0027s recommended to use Display/to_string\n instead.\n\nUpdate to version 1.41.1:\n\n - Always check types of static items\n - Always check lifetime bounds of `Copy` impls\n - Fix miscompilation in callers of `Layout::repeat`\n\nUpdate to version 1.41.0:\n\n+ Language\n\n - You can now pass type parameters to foreign items when implementing\n traits. E.g. You can now write `impl\u003cT\u003e From\u003cFoo\u003e for Vec\u003cT\u003e {}`.\n - You can now arbitrarily nest receiver types in the `self` position. E.g. you can\n now write `fn foo(self: Box\u003cBox\u003cSelf\u003e\u003e) {}`. Previously only `Self`, `\u0026Self`,\n `\u0026mut Self`, `Arc\u003cSelf\u003e`, `Rc\u003cSelf\u003e`, and `Box\u003cSelf\u003e` were allowed.\n - You can now use any valid identifier in a `format_args` macro.\n Previously identifiers starting with an underscore were not allowed.\n - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and\n enum variants. These are still rejected semantically, but\n can be seen and parsed by procedural macros and conditional compilation.\n \n+ Compiler\n\n - Rustc will now warn if you have unused loop `\u0027label`s.\n - Removed support for the `i686-unknown-dragonfly` target.\n - Added tier 3 support\\* for the `riscv64gc-unknown-linux-gnu` target.\n - You can now pass an arguments file passing the `@path` syntax\n to rustc. Note that the format differs somewhat from what is\n found in other tooling; please see the documentation for\n more information.\n - You can now provide `--extern` flag without a path, indicating that it is\n available from the search path or specified with an `-L` flag.\n \n Refer to Rust\u0027s [platform support page][forge-platform-support] for more\n information on Rust\u0027s tiered platform support.\n \n+ Libraries\n\n - The `core::panic` module is now stable. It was already stable\n through `std`.\n - `NonZero*` numerics now implement `From\u003cNonZero*\u003e` if it\u0027s a smaller integer\n width. E.g. `NonZeroU16` now implements `From\u003cNonZeroU8\u003e`.\n - `MaybeUninit\u003cT\u003e` now implements `fmt::Debug`.\n \n+ Stabilized APIs\n\n - `Result::map_or`\n - `Result::map_or_else`\n - `std::rc::Weak::weak_count`\n - `std::rc::Weak::strong_count`\n - `std::sync::Weak::weak_count`\n - `std::sync::Weak::strong_count`\n \n+ Cargo\n\n - Cargo will now document all the private items for binary crates\n by default.\n - `cargo-install` will now reinstall the package if it detects that it is out\n of date.\n - Cargo.lock now uses a more git friendly format that should help to reduce\n merge conflicts.\n - You can now override specific dependencies\u0027s build settings. E.g.\n `[profile.dev.package.image] opt-level = 2` sets the `image` crate\u0027s\n optimisation level to `2` for debug builds. You can also use\n `[profile.\u003cprofile\u003e.build-override]` to override build scripts and\n their dependencies.\n\n+ Misc\n\n - You can now specify `edition` in documentation code blocks to compile the block\n for that edition. E.g. `edition2018` tells rustdoc that the code sample\n should be compiled the 2018 edition of Rust.\n - You can now provide custom themes to rustdoc with `--theme`, and check the\n current theme with `--check-theme`.\n - You can use `#[cfg(doc)]` to compile an item when building documentation.\n \n+ Compatibility Notes\n\n - As previously announced 1.41.0 will be the last tier 1 release for 32-bit\n Apple targets. This means that the source code is still\n available to build, but the targets are no longer being tested and release\n binaries for those platforms will no longer be distributed by the Rust project.\n Please refer to the linked blog post for more information.\n\n- Bump version of libssh2 for SLE15; we now need a version with\n libssh2_userauth_publickey_frommemory(), which appeared in libssh2\n 1.6.0.\n\nUpdate to version 1.40.0\n\n+ Language\n\n - You can now use tuple `struct`s and tuple `enum` variant\u0027s constructors in\n `const` contexts. e.g.\n pub struct Point(i32, i32);\n const ORIGIN: Point = {\n let constructor = Point;\n constructor(0, 0)\n };\n - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to\n indicate that there may be variants or fields added in the future.\n For example this requires adding a wild-card branch (`_ =\u003e {}`) to any match\n statements on a non-exhaustive `enum`.\n - You can now use function-like procedural macros in `extern` blocks and in\n type positions. e.g. `type Generated = macro!();`\n - Function-like and attribute procedural macros can now emit\n `macro_rules!` items, so you can now have your macros generate macros.\n - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern\n attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,\n `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.\n\n+ Compiler\n\n - Added tier 3 support\\* for the\n `thumbv7neon-unknown-linux-musleabihf` target.\n - Added tier 3 support for the\n `aarch64-unknown-none-softfloat` target.\n - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and\n `mips64el-unknown-linux-muslabi64` targets.\n\n+ Libraries\n\n - The `is_power_of_two` method on unsigned numeric types is now a `const` function.\n\n+ Stabilized APIs\n\n - BTreeMap::get_key_value\n - HashMap::get_key_value\n - Option::as_deref_mut\n - Option::as_deref\n - Option::flatten\n - UdpSocket::peer_addr\n - f32::to_be_bytes\n - f32::to_le_bytes\n - f32::to_ne_bytes\n - f64::to_be_bytes\n - f64::to_le_bytes\n - f64::to_ne_bytes\n - f32::from_be_bytes\n - f32::from_le_bytes\n - f32::from_ne_bytes\n - f64::from_be_bytes\n - f64::from_le_bytes\n - f64::from_ne_bytes\n - mem::take\n - slice::repeat\n - todo!\n\n+ Cargo\n\n - Cargo will now always display warnings, rather than only on\n fresh builds.\n - Feature flags (except `--all-features`) passed to a virtual workspace will\n now produce an error. Previously these flags were ignored.\n - You can now publish `dev-dependencies` without including\n a `version`.\n\n+ Misc\n\n - You can now specify the `#[cfg(doctest)]` attribute to include an item only\n when running documentation tests with `rustdoc`.\n\n+ Compatibility Notes\n\n - As previously announced, any previous NLL warnings in the 2015 edition are\n now hard errors.\n - The `include!` macro will now warn if it failed to include the\n entire file. The `include!` macro unintentionally only includes the\n first _expression_ in a file, and this can be unintuitive. This will become\n either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.\n - Using `#[inline]` on function prototypes and consts now emits a warning under\n `unused_attribute` lint. Using `#[inline]` anywhere else inside traits\n or `extern` blocks now correctly emits a hard error.\n\nUpdate to version 1.39.0\n\n+ Language\n\n - You can now create async functions and blocks with async fn,\n async move {}, and async {} respectively, and you can now call\n .await on async expressions.\n - You can now use certain attributes on function, closure, and\n function pointer parameters.\n - You can now take shared references to bind-by-move patterns in\n the if guards of match arms.\n\n+ Compiler\n\n - Added tier 3 support for the i686-unknown-uefi target.\n - Added tier 3 support for the sparc64-unknown-openbsd target.\n - rustc will now trim code snippets in diagnostics to fit in your\n terminal.\n - You can now pass --show-output argument to test binaries to\n print the output of successful tests.\n\n+ For more details:\n https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07\n\n- Switch to bundled version of libgit2 for now. libgit2-sys seems\n to expect using the bundled variant, which just seems to point\n to a snapshot of the master branch and doesn\u0027t match any released\n libgit2 (bsc#1154817).\n See: https://github.com/rust-lang/rust/issues/63476 and\n https://github.com/rust-lang/git2-rs/issues/458 for details.\n\nUpdate to version 1.38.0\n\n+ Language\n\n - The `#[global_allocator]` attribute can now be used in submodules.\n - The `#[deprecated]` attribute can now be used on macros.\n\n+ Compiler\n\n - Added pipelined compilation support to `rustc`. This will\n improve compilation times in some cases.\n\n+ Libraries\n\n - `ascii::EscapeDefault` now implements `Clone` and `Display`.\n - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now\n available at the same path as the trait. (e.g. The `Clone` derive macro\n is available at `std::clone::Clone`). This also makes all built-in macros\n available in `std`/`core` root. e.g. `std::include_bytes!`.\n - `str::Chars` now implements `Debug`.\n - `slice::{concat, connect, join}` now accepts `\u0026[T]` in addition to `\u0026T`.\n - `*const T` and `*mut T` now implement `marker::Unpin`.\n - `Arc\u003c[T]\u003e` and `Rc\u003c[T]\u003e` now implement `FromIterator\u003cT\u003e`.\n - Added euclidean remainder and division operations (`div_euclid`,\n `rem_euclid`) to all numeric primitives. Additionally `checked`,\n `overflowing`, and `wrapping` versions are available for all\n integer primitives.\n - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and\n `PartialEq`.\n - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.\n\n+ Stabilized APIs\n\n - `\u003c*const T\u003e::cast`\n - `\u003c*mut T\u003e::cast`\n - `Duration::as_secs_f32`\n - `Duration::as_secs_f64`\n - `Duration::div_f32`\n - `Duration::div_f64`\n - `Duration::from_secs_f32`\n - `Duration::from_secs_f64`\n - `Duration::mul_f32`\n - `Duration::mul_f64`\n - `any::type_name`\n\n+ Cargo\n\n - Added pipelined compilation support to `cargo`.\n - You can now pass the `--features` option multiple times to enable\n multiple features.\n\n+ Misc\n\n - `rustc` will now warn about some incorrect uses of\n `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.\n\nUpdate to version 1.37.0\n\n + Language\n\n - #[must_use] will now warn if the type is contained in a tuple,\n Box, or an array and unused.\n - You can now use the `cfg` and `cfg_attr` attributes on\n generic parameters.\n - You can now use enum variants through type alias. e.g. You can\n write the following:\n ```\n type MyOption = Option\u003cu8\u003e;\n fn increment_or_zero(x: MyOption) -\u003e u8 {\n match x {\n MyOption::Some(y) =\u003e y + 1,\n MyOption::None =\u003e 0,\n }\n }\n ```\n - You can now use `_` as an identifier for consts. e.g. You can write\n `const _: u32 = 5;`.\n - You can now use `#[repr(align(X)]` on enums.\n - The `?` Kleene macro operator is now available in the\n 2015 edition.\n\n + Compiler\n\n - You can now enable Profile-Guided Optimization with the `-C profile-generate`\n and `-C profile-use` flags. For more information on how to use profile\n guided optimization, please refer to the rustc book.\n - The `rust-lldb` wrapper script should now work again.\n\n + Libraries\n\n - `mem::MaybeUninit\u003cT\u003e` is now ABI-compatible with `T`.\n\n + Stabilized APIs\n\n - BufReader::buffer\n - BufWriter::buffer\n - Cell::from_mut\n - Cell\u003c[T]\u003e::as_slice_of_cells\n - Cell\u003cslice\u003e::as_slice_of_cells\n - DoubleEndedIterator::nth_back\n - Option::xor\n - Wrapping::reverse_bits\n - i128::reverse_bits\n - i16::reverse_bits\n - i32::reverse_bits\n - i64::reverse_bits\n - i8::reverse_bits\n - isize::reverse_bits\n - slice::copy_within\n - u128::reverse_bits\n - u16::reverse_bits\n - u32::reverse_bits\n - u64::reverse_bits\n - u8::reverse_bits\n - usize::reverse_bits\n\n + Cargo\n\n - Cargo.lock files are now included by default when publishing executable crates\n with executables.\n - You can now specify `default-run=\u0027foo\u0027` in `[package]` to specify the\n default executable to use for `cargo run`.\n - cargo-vendor is now provided as a sub-command of cargo\n\n + Compatibility Notes\n\n - Using `...` for inclusive range patterns will now warn by default.\n Please transition your code to using the `..=` syntax for inclusive\n ranges instead.\n - Using a trait object without the `dyn` will now warn by default.\n Please transition your code to use `dyn Trait` for trait objects instead.\n Crab(String),\n Lobster(String),\n Person(String),\n let state = Creature::Crab(\u0027Ferris\u0027);\n if let Creature::Crab(name) | Creature::Person(name) = state {\n println!(\u0027This creature\u0027s name is: {}\u0027, name);\n }\n unsafe { foo() }\n pub fn new(x: i32, y: i32) -\u003e Self {\n Self(x, y)\n }\n pub fn is_origin(\u0026self) -\u003e bool {\n match self {\n Self(0, 0) =\u003e true,\n _ =\u003e false,\n }\n }\n Self: PartialOrd\u003cSelf\u003e // can write `Self` instead of `List\u003cT\u003e`\n Nil,\n Cons(T, Box\u003cSelf\u003e) // likewise here\n fn test(\u0026self) { println!(\u0027one\u0027); } //~ ERROR duplicate definitions with name `test`\n fn test(\u0026self) { println!(\u0027two\u0027); }\n\n* Basic procedural macros allowing custom `#[derive]`, aka \u0027macros 1.1\u0027, are\n stable. This allows popular code-generating crates like Serde and Diesel to\n work ergonomically. [RFC 1681].\n* [Tuple structs may be empty. Unary and empty tuple structs may be instantiated\n with curly braces][36868]. Part of [RFC 1506].\n* [A number of minor changes to name resolution have been activated][37127].\n They add up to more consistent semantics, allowing for future evolution of\n Rust macros. Specified in [RFC 1560], see its section on [\u0027changes\u0027] for\n details of what is different. The breaking changes here have been transitioned\n through the [`legacy_imports`] lint since 1.14, with no known regressions.\n* [In `macro_rules`, `path` fragments can now be parsed as type parameter\n bounds][38279]\n* [`?Sized` can be used in `where` clauses][37791]\n* [There is now a limit on the size of monomorphized types and it can be\n modified with the `#![type_size_limit]` crate attribute, similarly to\n the `#![recursion_limit]` attribute][37789]\n* [On Windows, the compiler will apply dllimport attributes when linking to\n extern functions][37973]. Additional attributes and flags can control which\n library kind is linked and its name. [RFC 1717].\n* [Rust-ABI symbols are no longer exported from cdylibs][38117]\n* [The `--test` flag works with procedural macro crates][38107]\n* [Fix `extern \u0027aapcs\u0027 fn` ABI][37814]\n* [The `-C no-stack-check` flag is deprecated][37636]. It does nothing.\n* [The `format!` expander recognizes incorrect `printf` and shell-style\n formatting directives and suggests the correct format][37613].\n* [Only report one error for all unused imports in an import list][37456]\n* [Avoid unnecessary `mk_ty` calls in `Ty::super_fold_with`][37705]\n* [Avoid more unnecessary `mk_ty` calls in `Ty::super_fold_with`][37979]\n* [Don\u0027t clone in `UnificationTable::probe`][37848]\n* [Remove `scope_auxiliary` to cut RSS by 10%][37764]\n* [Use small vectors in type walker][37760]\n* [Macro expansion performance was improved][37701]\n* [Change `HirVec\u003cP\u003cT\u003e\u003e` to `HirVec\u003cT\u003e` in `hir::Expr`][37642]\n* [Replace FNV with a faster hash function][37229]\n https://raw.githubusercontent.com/rust-lang/rust/master/RELEASES.md\n\nrust-cbindgen is shipped in version 0.14.1.\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-933",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0933-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:0933-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F5H7V5OW6UBVFHCH47YCKODMLJ7D63J7/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:0933-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F5H7V5OW6UBVFHCH47YCKODMLJ7D63J7/"
},
{
"category": "self",
"summary": "SUSE Bug 1115645",
"url": "https://bugzilla.suse.com/1115645"
},
{
"category": "self",
"summary": "SUSE Bug 1154817",
"url": "https://bugzilla.suse.com/1154817"
},
{
"category": "self",
"summary": "SUSE Bug 1173202",
"url": "https://bugzilla.suse.com/1173202"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-1967 page",
"url": "https://www.suse.com/security/cve/CVE-2020-1967/"
}
],
"title": "Security update for rust, rust-cbindgen",
"tracking": {
"current_release_date": "2020-07-06T12:56:10Z",
"generator": {
"date": "2020-07-06T12:56:10Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:0933-1",
"initial_release_date": "2020-07-06T12:56:10Z",
"revision_history": [
{
"date": "2020-07-06T12:56:10Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cargo-1.43.1-lp151.5.13.1.i586",
"product": {
"name": "cargo-1.43.1-lp151.5.13.1.i586",
"product_id": "cargo-1.43.1-lp151.5.13.1.i586"
}
},
{
"category": "product_version",
"name": "clippy-1.43.1-lp151.5.13.1.i586",
"product": {
"name": "clippy-1.43.1-lp151.5.13.1.i586",
"product_id": "clippy-1.43.1-lp151.5.13.1.i586"
}
},
{
"category": "product_version",
"name": "rls-1.43.1-lp151.5.13.1.i586",
"product": {
"name": "rls-1.43.1-lp151.5.13.1.i586",
"product_id": "rls-1.43.1-lp151.5.13.1.i586"
}
},
{
"category": "product_version",
"name": "rust-1.43.1-lp151.5.13.1.i586",
"product": {
"name": "rust-1.43.1-lp151.5.13.1.i586",
"product_id": "rust-1.43.1-lp151.5.13.1.i586"
}
},
{
"category": "product_version",
"name": "rust-analysis-1.43.1-lp151.5.13.1.i586",
"product": {
"name": "rust-analysis-1.43.1-lp151.5.13.1.i586",
"product_id": "rust-analysis-1.43.1-lp151.5.13.1.i586"
}
},
{
"category": "product_version",
"name": "rust-doc-1.43.1-lp151.5.13.1.i586",
"product": {
"name": "rust-doc-1.43.1-lp151.5.13.1.i586",
"product_id": "rust-doc-1.43.1-lp151.5.13.1.i586"
}
},
{
"category": "product_version",
"name": "rust-gdb-1.43.1-lp151.5.13.1.i586",
"product": {
"name": "rust-gdb-1.43.1-lp151.5.13.1.i586",
"product_id": "rust-gdb-1.43.1-lp151.5.13.1.i586"
}
},
{
"category": "product_version",
"name": "rust-std-static-1.43.1-lp151.5.13.1.i586",
"product": {
"name": "rust-std-static-1.43.1-lp151.5.13.1.i586",
"product_id": "rust-std-static-1.43.1-lp151.5.13.1.i586"
}
},
{
"category": "product_version",
"name": "rustfmt-1.43.1-lp151.5.13.1.i586",
"product": {
"name": "rustfmt-1.43.1-lp151.5.13.1.i586",
"product_id": "rustfmt-1.43.1-lp151.5.13.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "cargo-doc-1.43.1-lp151.5.13.1.noarch",
"product": {
"name": "cargo-doc-1.43.1-lp151.5.13.1.noarch",
"product_id": "cargo-doc-1.43.1-lp151.5.13.1.noarch"
}
},
{
"category": "product_version",
"name": "rust-src-1.43.1-lp151.5.13.1.noarch",
"product": {
"name": "rust-src-1.43.1-lp151.5.13.1.noarch",
"product_id": "rust-src-1.43.1-lp151.5.13.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cargo-1.43.1-lp151.5.13.1.x86_64",
"product": {
"name": "cargo-1.43.1-lp151.5.13.1.x86_64",
"product_id": "cargo-1.43.1-lp151.5.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "clippy-1.43.1-lp151.5.13.1.x86_64",
"product": {
"name": "clippy-1.43.1-lp151.5.13.1.x86_64",
"product_id": "clippy-1.43.1-lp151.5.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "rls-1.43.1-lp151.5.13.1.x86_64",
"product": {
"name": "rls-1.43.1-lp151.5.13.1.x86_64",
"product_id": "rls-1.43.1-lp151.5.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-1.43.1-lp151.5.13.1.x86_64",
"product": {
"name": "rust-1.43.1-lp151.5.13.1.x86_64",
"product_id": "rust-1.43.1-lp151.5.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-analysis-1.43.1-lp151.5.13.1.x86_64",
"product": {
"name": "rust-analysis-1.43.1-lp151.5.13.1.x86_64",
"product_id": "rust-analysis-1.43.1-lp151.5.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-cbindgen-0.14.1-lp151.8.2.x86_64",
"product": {
"name": "rust-cbindgen-0.14.1-lp151.8.2.x86_64",
"product_id": "rust-cbindgen-0.14.1-lp151.8.2.x86_64"
}
},
{
"category": "product_version",
"name": "rust-doc-1.43.1-lp151.5.13.1.x86_64",
"product": {
"name": "rust-doc-1.43.1-lp151.5.13.1.x86_64",
"product_id": "rust-doc-1.43.1-lp151.5.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-gdb-1.43.1-lp151.5.13.1.x86_64",
"product": {
"name": "rust-gdb-1.43.1-lp151.5.13.1.x86_64",
"product_id": "rust-gdb-1.43.1-lp151.5.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-std-static-1.43.1-lp151.5.13.1.x86_64",
"product": {
"name": "rust-std-static-1.43.1-lp151.5.13.1.x86_64",
"product_id": "rust-std-static-1.43.1-lp151.5.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "rustfmt-1.43.1-lp151.5.13.1.x86_64",
"product": {
"name": "rustfmt-1.43.1-lp151.5.13.1.x86_64",
"product_id": "rustfmt-1.43.1-lp151.5.13.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cargo-1.43.1-lp151.5.13.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.i586"
},
"product_reference": "cargo-1.43.1-lp151.5.13.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cargo-1.43.1-lp151.5.13.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.x86_64"
},
"product_reference": "cargo-1.43.1-lp151.5.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cargo-doc-1.43.1-lp151.5.13.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cargo-doc-1.43.1-lp151.5.13.1.noarch"
},
"product_reference": "cargo-doc-1.43.1-lp151.5.13.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "clippy-1.43.1-lp151.5.13.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.i586"
},
"product_reference": "clippy-1.43.1-lp151.5.13.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "clippy-1.43.1-lp151.5.13.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.x86_64"
},
"product_reference": "clippy-1.43.1-lp151.5.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rls-1.43.1-lp151.5.13.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.i586"
},
"product_reference": "rls-1.43.1-lp151.5.13.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rls-1.43.1-lp151.5.13.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.x86_64"
},
"product_reference": "rls-1.43.1-lp151.5.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-1.43.1-lp151.5.13.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.i586"
},
"product_reference": "rust-1.43.1-lp151.5.13.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-1.43.1-lp151.5.13.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.x86_64"
},
"product_reference": "rust-1.43.1-lp151.5.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-analysis-1.43.1-lp151.5.13.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.i586"
},
"product_reference": "rust-analysis-1.43.1-lp151.5.13.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-analysis-1.43.1-lp151.5.13.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.x86_64"
},
"product_reference": "rust-analysis-1.43.1-lp151.5.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-cbindgen-0.14.1-lp151.8.2.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-cbindgen-0.14.1-lp151.8.2.x86_64"
},
"product_reference": "rust-cbindgen-0.14.1-lp151.8.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-doc-1.43.1-lp151.5.13.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.i586"
},
"product_reference": "rust-doc-1.43.1-lp151.5.13.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-doc-1.43.1-lp151.5.13.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.x86_64"
},
"product_reference": "rust-doc-1.43.1-lp151.5.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-gdb-1.43.1-lp151.5.13.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.i586"
},
"product_reference": "rust-gdb-1.43.1-lp151.5.13.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-gdb-1.43.1-lp151.5.13.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.x86_64"
},
"product_reference": "rust-gdb-1.43.1-lp151.5.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-src-1.43.1-lp151.5.13.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-src-1.43.1-lp151.5.13.1.noarch"
},
"product_reference": "rust-src-1.43.1-lp151.5.13.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-std-static-1.43.1-lp151.5.13.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.i586"
},
"product_reference": "rust-std-static-1.43.1-lp151.5.13.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-std-static-1.43.1-lp151.5.13.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.x86_64"
},
"product_reference": "rust-std-static-1.43.1-lp151.5.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rustfmt-1.43.1-lp151.5.13.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.i586"
},
"product_reference": "rustfmt-1.43.1-lp151.5.13.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rustfmt-1.43.1-lp151.5.13.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.x86_64"
},
"product_reference": "rustfmt-1.43.1-lp151.5.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-1967",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-1967"
}
],
"notes": [
{
"category": "general",
"text": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:cargo-doc-1.43.1-lp151.5.13.1.noarch",
"openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-cbindgen-0.14.1-lp151.8.2.x86_64",
"openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-src-1.43.1-lp151.5.13.1.noarch",
"openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-1967",
"url": "https://www.suse.com/security/cve/CVE-2020-1967"
},
{
"category": "external",
"summary": "SUSE Bug 1169407 for CVE-2020-1967",
"url": "https://bugzilla.suse.com/1169407"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:cargo-doc-1.43.1-lp151.5.13.1.noarch",
"openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-cbindgen-0.14.1-lp151.8.2.x86_64",
"openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-src-1.43.1-lp151.5.13.1.noarch",
"openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:cargo-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:cargo-doc-1.43.1-lp151.5.13.1.noarch",
"openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:clippy-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rls-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-analysis-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-cbindgen-0.14.1-lp151.8.2.x86_64",
"openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-doc-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-gdb-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rust-src-1.43.1-lp151.5.13.1.noarch",
"openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rust-std-static-1.43.1-lp151.5.13.1.x86_64",
"openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.i586",
"openSUSE Leap 15.1:rustfmt-1.43.1-lp151.5.13.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-06T12:56:10Z",
"details": "important"
}
],
"title": "CVE-2020-1967"
}
]
}
OPENSUSE-SU-2020:0945-1
Vulnerability from csaf_opensuse - Published: 2020-07-07 05:51 - Updated: 2020-07-07 05:51Summary
Security update for rust, rust-cbindgen
Severity
Moderate
Notes
Title of the patch: Security update for rust, rust-cbindgen
Description of the patch: This update for rust, rust-cbindgen fixes the following issues:
rust was updated for use by Firefox 76ESR.
- Fixed miscompilations with rustc 1.43 that lead to LTO failures (bsc#1173202)
Update to version 1.43.1
- Updated openssl-src to 1.1.1g for CVE-2020-1967.
- Fixed the stabilization of AVX-512 features.
- Fixed `cargo package --list` not working with unpublished dependencies.
Update to version 1.43.0
+ Language:
- Fixed using binary operations with `&{number}` (e.g. `&1.0`)
not having the type inferred correctly.
- Attributes such as `#[cfg()]` can now be used on `if`
expressions.
- Syntax only changes:
* Allow `type Foo: Ord` syntactically.
* Fuse associated and extern items up to defaultness.
* Syntactically allow `self` in all `fn` contexts.
* Merge `fn` syntax + cleanup item parsing.
* `item` macro fragments can be interpolated into `trait`s,
`impl`s, and `extern` blocks.
For example, you may now write:
```rust
macro_rules! mac_trait {
($i:item) => {
trait T { $i }
}
}
mac_trait! {
fn foo() {}
}
```
* These are still rejected *semantically*, so you will likely
receive an error but these changes can be seen and parsed by
macros and conditional compilation.
+ Compiler
- You can now pass multiple lint flags to rustc to override the previous flags.
For example; `rustc -D unused -A unused-variables` denies
everything in the `unused` lint group except `unused-variables`
which is explicitly allowed. However, passing
`rustc -A unused-variables -D unused` denies everything in
the `unused` lint group **including** `unused-variables` since
the allow flag is specified before the deny flag (and therefore
overridden).
- rustc will now prefer your system MinGW libraries over its
bundled libraries if they are available on `windows-gnu`.
- rustc now buffers errors/warnings printed in JSON.
Libraries:
- `Arc<[T; N]>`, `Box<[T; N]>`, and `Rc<[T; N]>`, now implement
`TryFrom<Arc<[T]>>`,`TryFrom<Box<[T]>>`, and `TryFrom<Rc<[T]>>`
respectively.
**Note** These conversions are only available when `N` is
`0..=32`.
- You can now use associated constants on floats and integers
directly, rather than having to import the module.
e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
- `u8::is_ascii` is now `const`.
- `String` now implements `AsMut<str>`.
- Added the `primitive` module to `std` and `core`.
This module reexports Rust's primitive types. This is mainly
useful in macros where you want avoid these types being shadowed.
- Relaxed some of the trait bounds on `HashMap` and `HashSet`.
- `string::FromUtf8Error` now implements `Clone + Eq`.
+ Stabilized APIs
- `Once::is_completed`
- `f32::LOG10_2`
- `f32::LOG2_10`
- `f64::LOG10_2`
- `f64::LOG2_10`
- `iter::once_with`
+ Cargo
- You can now set config `[profile]`s in your `.cargo/config`,
or through your environment.
- Cargo will now set `CARGO_BIN_EXE_<name>` pointing to a
binary's executable path when running integration tests or
benchmarks.
`<name>` is the name of your binary as-is e.g. If you wanted
the executable path for a binary named `my-program`you would
use `env!('CARGO_BIN_EXE_my-program')`.
+ Misc
- Certain checks in the `const_err` lint were deemed unrelated
to const evaluation, and have been moved to the
`unconditional_panic` and `arithmetic_overflow` lints.
+ Compatibility Notes
- Having trailing syntax in the `assert!` macro is now a hard
error. This has been a warning since 1.36.0.
- Fixed `Self` not having the correctly inferred type. This
incorrectly led to some instances being accepted, and now
correctly emits a hard error.
Update to version 1.42.0:
+ Language
- You can now use the slice pattern syntax with subslices.
- You can now use #[repr(transparent)] on univariant enums. Meaning
that you can create an enum that has the exact layout and ABI of
the type it contains.
- There are some syntax-only changes:
* default is syntactically allowed before items in trait
definitions.
* Items in impls (i.e. consts, types, and fns) may syntactically
leave out their bodies in favor of ;.
* Bounds on associated types in impls are now syntactically
allowed (e.g. type Foo: Ord;).
* ... (the C-variadic type) may occur syntactically directly
as the type of any function parameter.
These are still rejected semantically, so you will likely receive
an error but these changes can be seen and parsed by procedural
macros and conditional compilation.
+ Compiler
- Added tier 2 support for armv7a-none-eabi.
- Added tier 2 support for riscv64gc-unknown-linux-gnu.
- Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
unwrap_err} now produce panic messages pointing to the location
where they were called, rather than core's internals.
Refer to Rust's platform support page for more information on
Rust's tiered platform support.
+ Libraries
- iter::Empty<T> now implements Send and Sync for any T.
- Pin::{map_unchecked, map_unchecked_mut} no longer require the
return type to implement Sized.
- io::Cursor now derives PartialEq and Eq.
- Layout::new is now const.
- Added Standard Library support for riscv64gc-unknown-linux-gnu.
+ Stabilized APIs
- CondVar::wait_while
- CondVar::wait_timeout_while
- DebugMap::key
- DebugMap::value
- ManuallyDrop::take
- matches!
- ptr::slice_from_raw_parts_mut
- ptr::slice_from_raw_parts
+ Cargo
- You no longer need to include extern crate proc_macro; to be
able to use proc_macro; in the 2018 edition.
+ Compatibility Notes
- Error::description has been deprecated, and its use will now
produce a warning. It's recommended to use Display/to_string
instead.
Update to version 1.41.1:
- Always check types of static items
- Always check lifetime bounds of `Copy` impls
- Fix miscompilation in callers of `Layout::repeat`
Update to version 1.41.0:
+ Language
- You can now pass type parameters to foreign items when implementing
traits. E.g. You can now write `impl<T> From<Foo> for Vec<T> {}`.
- You can now arbitrarily nest receiver types in the `self` position. E.g. you can
now write `fn foo(self: Box<Box<Self>>) {}`. Previously only `Self`, `&Self`,
`&mut Self`, `Arc<Self>`, `Rc<Self>`, and `Box<Self>` were allowed.
- You can now use any valid identifier in a `format_args` macro.
Previously identifiers starting with an underscore were not allowed.
- Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
enum variants. These are still rejected semantically, but
can be seen and parsed by procedural macros and conditional compilation.
+ Compiler
- Rustc will now warn if you have unused loop `'label`s.
- Removed support for the `i686-unknown-dragonfly` target.
- Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
- You can now pass an arguments file passing the `@path` syntax
to rustc. Note that the format differs somewhat from what is
found in other tooling; please see the documentation for
more information.
- You can now provide `--extern` flag without a path, indicating that it is
available from the search path or specified with an `-L` flag.
Refer to Rust's [platform support page][forge-platform-support] for more
information on Rust's tiered platform support.
+ Libraries
- The `core::panic` module is now stable. It was already stable
through `std`.
- `NonZero*` numerics now implement `From<NonZero*>` if it's a smaller integer
width. E.g. `NonZeroU16` now implements `From<NonZeroU8>`.
- `MaybeUninit<T>` now implements `fmt::Debug`.
+ Stabilized APIs
- `Result::map_or`
- `Result::map_or_else`
- `std::rc::Weak::weak_count`
- `std::rc::Weak::strong_count`
- `std::sync::Weak::weak_count`
- `std::sync::Weak::strong_count`
+ Cargo
- Cargo will now document all the private items for binary crates
by default.
- `cargo-install` will now reinstall the package if it detects that it is out
of date.
- Cargo.lock now uses a more git friendly format that should help to reduce
merge conflicts.
- You can now override specific dependencies's build settings. E.g.
`[profile.dev.package.image] opt-level = 2` sets the `image` crate's
optimisation level to `2` for debug builds. You can also use
`[profile.<profile>.build-override]` to override build scripts and
their dependencies.
+ Misc
- You can now specify `edition` in documentation code blocks to compile the block
for that edition. E.g. `edition2018` tells rustdoc that the code sample
should be compiled the 2018 edition of Rust.
- You can now provide custom themes to rustdoc with `--theme`, and check the
current theme with `--check-theme`.
- You can use `#[cfg(doc)]` to compile an item when building documentation.
+ Compatibility Notes
- As previously announced 1.41.0 will be the last tier 1 release for 32-bit
Apple targets. This means that the source code is still
available to build, but the targets are no longer being tested and release
binaries for those platforms will no longer be distributed by the Rust project.
Please refer to the linked blog post for more information.
- Bump version of libssh2 for SLE15; we now need a version with
libssh2_userauth_publickey_frommemory(), which appeared in libssh2
1.6.0.
Update to version 1.40.0
+ Language
- You can now use tuple `struct`s and tuple `enum` variant's constructors in
`const` contexts. e.g.
pub struct Point(i32, i32);
const ORIGIN: Point = {
let constructor = Point;
constructor(0, 0)
};
- You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
indicate that there may be variants or fields added in the future.
For example this requires adding a wild-card branch (`_ => {}`) to any match
statements on a non-exhaustive `enum`.
- You can now use function-like procedural macros in `extern` blocks and in
type positions. e.g. `type Generated = macro!();`
- Function-like and attribute procedural macros can now emit
`macro_rules!` items, so you can now have your macros generate macros.
- The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
`#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
+ Compiler
- Added tier 3 support\* for the
`thumbv7neon-unknown-linux-musleabihf` target.
- Added tier 3 support for the
`aarch64-unknown-none-softfloat` target.
- Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
`mips64el-unknown-linux-muslabi64` targets.
+ Libraries
- The `is_power_of_two` method on unsigned numeric types is now a `const` function.
+ Stabilized APIs
- BTreeMap::get_key_value
- HashMap::get_key_value
- Option::as_deref_mut
- Option::as_deref
- Option::flatten
- UdpSocket::peer_addr
- f32::to_be_bytes
- f32::to_le_bytes
- f32::to_ne_bytes
- f64::to_be_bytes
- f64::to_le_bytes
- f64::to_ne_bytes
- f32::from_be_bytes
- f32::from_le_bytes
- f32::from_ne_bytes
- f64::from_be_bytes
- f64::from_le_bytes
- f64::from_ne_bytes
- mem::take
- slice::repeat
- todo!
+ Cargo
- Cargo will now always display warnings, rather than only on
fresh builds.
- Feature flags (except `--all-features`) passed to a virtual workspace will
now produce an error. Previously these flags were ignored.
- You can now publish `dev-dependencies` without including
a `version`.
+ Misc
- You can now specify the `#[cfg(doctest)]` attribute to include an item only
when running documentation tests with `rustdoc`.
+ Compatibility Notes
- As previously announced, any previous NLL warnings in the 2015 edition are
now hard errors.
- The `include!` macro will now warn if it failed to include the
entire file. The `include!` macro unintentionally only includes the
first _expression_ in a file, and this can be unintuitive. This will become
either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
- Using `#[inline]` on function prototypes and consts now emits a warning under
`unused_attribute` lint. Using `#[inline]` anywhere else inside traits
or `extern` blocks now correctly emits a hard error.
Update to version 1.39.0
+ Language
- You can now create async functions and blocks with async fn,
async move {}, and async {} respectively, and you can now call
.await on async expressions.
- You can now use certain attributes on function, closure, and
function pointer parameters.
- You can now take shared references to bind-by-move patterns in
the if guards of match arms.
+ Compiler
- Added tier 3 support for the i686-unknown-uefi target.
- Added tier 3 support for the sparc64-unknown-openbsd target.
- rustc will now trim code snippets in diagnostics to fit in your
terminal.
- You can now pass --show-output argument to test binaries to
print the output of successful tests.
+ For more details:
https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Switch to bundled version of libgit2 for now. libgit2-sys seems
to expect using the bundled variant, which just seems to point
to a snapshot of the master branch and doesn't match any released
libgit2 (bsc#1154817).
See: https://github.com/rust-lang/rust/issues/63476 and
https://github.com/rust-lang/git2-rs/issues/458 for details.
Update to version 1.38.0
+ Language
- The `#[global_allocator]` attribute can now be used in submodules.
- The `#[deprecated]` attribute can now be used on macros.
+ Compiler
- Added pipelined compilation support to `rustc`. This will
improve compilation times in some cases.
+ Libraries
- `ascii::EscapeDefault` now implements `Clone` and `Display`.
- Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
available at the same path as the trait. (e.g. The `Clone` derive macro
is available at `std::clone::Clone`). This also makes all built-in macros
available in `std`/`core` root. e.g. `std::include_bytes!`.
- `str::Chars` now implements `Debug`.
- `slice::{concat, connect, join}` now accepts `&[T]` in addition to `&T`.
- `*const T` and `*mut T` now implement `marker::Unpin`.
- `Arc<[T]>` and `Rc<[T]>` now implement `FromIterator<T>`.
- Added euclidean remainder and division operations (`div_euclid`,
`rem_euclid`) to all numeric primitives. Additionally `checked`,
`overflowing`, and `wrapping` versions are available for all
integer primitives.
- `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
`PartialEq`.
- `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
+ Stabilized APIs
- `<*const T>::cast`
- `<*mut T>::cast`
- `Duration::as_secs_f32`
- `Duration::as_secs_f64`
- `Duration::div_f32`
- `Duration::div_f64`
- `Duration::from_secs_f32`
- `Duration::from_secs_f64`
- `Duration::mul_f32`
- `Duration::mul_f64`
- `any::type_name`
+ Cargo
- Added pipelined compilation support to `cargo`.
- You can now pass the `--features` option multiple times to enable
multiple features.
+ Misc
- `rustc` will now warn about some incorrect uses of
`mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.
Update to version 1.37.0
+ Language
- #[must_use] will now warn if the type is contained in a tuple,
Box, or an array and unused.
- You can now use the `cfg` and `cfg_attr` attributes on
generic parameters.
- You can now use enum variants through type alias. e.g. You can
write the following:
```
type MyOption = Option<u8>;
fn increment_or_zero(x: MyOption) -> u8 {
match x {
MyOption::Some(y) => y + 1,
MyOption::None => 0,
}
}
```
- You can now use `_` as an identifier for consts. e.g. You can write
`const _: u32 = 5;`.
- You can now use `#[repr(align(X)]` on enums.
- The `?` Kleene macro operator is now available in the
2015 edition.
+ Compiler
- You can now enable Profile-Guided Optimization with the `-C profile-generate`
and `-C profile-use` flags. For more information on how to use profile
guided optimization, please refer to the rustc book.
- The `rust-lldb` wrapper script should now work again.
+ Libraries
- `mem::MaybeUninit<T>` is now ABI-compatible with `T`.
+ Stabilized APIs
- BufReader::buffer
- BufWriter::buffer
- Cell::from_mut
- Cell<[T]>::as_slice_of_cells
- Cell<slice>::as_slice_of_cells
- DoubleEndedIterator::nth_back
- Option::xor
- Wrapping::reverse_bits
- i128::reverse_bits
- i16::reverse_bits
- i32::reverse_bits
- i64::reverse_bits
- i8::reverse_bits
- isize::reverse_bits
- slice::copy_within
- u128::reverse_bits
- u16::reverse_bits
- u32::reverse_bits
- u64::reverse_bits
- u8::reverse_bits
- usize::reverse_bits
+ Cargo
- Cargo.lock files are now included by default when publishing executable crates
with executables.
- You can now specify `default-run='foo'` in `[package]` to specify the
default executable to use for `cargo run`.
- cargo-vendor is now provided as a sub-command of cargo
+ Compatibility Notes
- Using `...` for inclusive range patterns will now warn by default.
Please transition your code to using the `..=` syntax for inclusive
ranges instead.
- Using a trait object without the `dyn` will now warn by default.
Please transition your code to use `dyn Trait` for trait objects instead.
Crab(String),
Lobster(String),
Person(String),
let state = Creature::Crab('Ferris');
if let Creature::Crab(name) | Creature::Person(name) = state {
println!('This creature's name is: {}', name);
}
unsafe { foo() }
pub fn new(x: i32, y: i32) -> Self {
Self(x, y)
}
pub fn is_origin(&self) -> bool {
match self {
Self(0, 0) => true,
_ => false,
}
}
Self: PartialOrd<Self> // can write `Self` instead of `List<T>`
Nil,
Cons(T, Box<Self>) // likewise here
fn test(&self) { println!('one'); } //~ ERROR duplicate definitions with name `test`
fn test(&self) { println!('two'); }
* Basic procedural macros allowing custom `#[derive]`, aka 'macros 1.1', are
stable. This allows popular code-generating crates like Serde and Diesel to
work ergonomically. [RFC 1681].
* [Tuple structs may be empty. Unary and empty tuple structs may be instantiated
with curly braces][36868]. Part of [RFC 1506].
* [A number of minor changes to name resolution have been activated][37127].
They add up to more consistent semantics, allowing for future evolution of
Rust macros. Specified in [RFC 1560], see its section on ['changes'] for
details of what is different. The breaking changes here have been transitioned
through the [`legacy_imports`] lint since 1.14, with no known regressions.
* [In `macro_rules`, `path` fragments can now be parsed as type parameter
bounds][38279]
* [`?Sized` can be used in `where` clauses][37791]
* [There is now a limit on the size of monomorphized types and it can be
modified with the `#![type_size_limit]` crate attribute, similarly to
the `#![recursion_limit]` attribute][37789]
* [On Windows, the compiler will apply dllimport attributes when linking to
extern functions][37973]. Additional attributes and flags can control which
library kind is linked and its name. [RFC 1717].
* [Rust-ABI symbols are no longer exported from cdylibs][38117]
* [The `--test` flag works with procedural macro crates][38107]
* [Fix `extern 'aapcs' fn` ABI][37814]
* [The `-C no-stack-check` flag is deprecated][37636]. It does nothing.
* [The `format!` expander recognizes incorrect `printf` and shell-style
formatting directives and suggests the correct format][37613].
* [Only report one error for all unused imports in an import list][37456]
* [Avoid unnecessary `mk_ty` calls in `Ty::super_fold_with`][37705]
* [Avoid more unnecessary `mk_ty` calls in `Ty::super_fold_with`][37979]
* [Don't clone in `UnificationTable::probe`][37848]
* [Remove `scope_auxiliary` to cut RSS by 10%][37764]
* [Use small vectors in type walker][37760]
* [Macro expansion performance was improved][37701]
* [Change `HirVec<P<T>>` to `HirVec<T>` in `hir::Expr`][37642]
* [Replace FNV with a faster hash function][37229]
https://raw.githubusercontent.com/rust-lang/rust/master/RELEASES.md
rust-cbindgen is shipped in version 0.14.1.
Patchnames: openSUSE-2020-945
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cargo-doc-1.43.1-lp152.3.5.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-cbindgen-0.14.1-lp152.2.4.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-src-1.43.1-lp152.3.5.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.i586 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
10 references
| URL | Category |
|---|---|
| https://www.suse.com/support/security/rating/ | external |
| https://ftp.suse.com/pub/projects/security/csaf/o… | self |
| https://lists.opensuse.org/archives/list/security… | self |
| https://lists.opensuse.org/archives/list/security… | self |
| https://bugzilla.suse.com/1115645 | self |
| https://bugzilla.suse.com/1154817 | self |
| https://bugzilla.suse.com/1173202 | self |
| https://www.suse.com/security/cve/CVE-2020-1967/ | self |
| https://www.suse.com/security/cve/CVE-2020-1967 | external |
| https://bugzilla.suse.com/1169407 | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for rust, rust-cbindgen",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for rust, rust-cbindgen fixes the following issues:\n\nrust was updated for use by Firefox 76ESR.\n\n- Fixed miscompilations with rustc 1.43 that lead to LTO failures (bsc#1173202)\n\nUpdate to version 1.43.1\n\n- Updated openssl-src to 1.1.1g for CVE-2020-1967.\n- Fixed the stabilization of AVX-512 features.\n- Fixed `cargo package --list` not working with unpublished dependencies.\n\nUpdate to version 1.43.0\n\n+ Language:\n\n- Fixed using binary operations with `\u0026{number}` (e.g. `\u00261.0`) \n not having the type inferred correctly.\n- Attributes such as `#[cfg()]` can now be used on `if` \n expressions.\n- Syntax only changes:\n * Allow `type Foo: Ord` syntactically.\n * Fuse associated and extern items up to defaultness.\n * Syntactically allow `self` in all `fn` contexts.\n * Merge `fn` syntax + cleanup item parsing.\n * `item` macro fragments can be interpolated into `trait`s, \n `impl`s, and `extern` blocks.\n For example, you may now write:\n ```rust \n macro_rules! mac_trait {\n ($i:item) =\u003e {\n trait T { $i }\n }\n }\n mac_trait! {\n fn foo() {}\n }\n ```\n * These are still rejected *semantically*, so you will likely \n receive an error but these changes can be seen and parsed by \n macros and conditional compilation.\n\n+ Compiler\n\n- You can now pass multiple lint flags to rustc to override the previous flags. \n\n For example; `rustc -D unused -A unused-variables` denies\n everything in the `unused` lint group except `unused-variables` \n which is explicitly allowed. However, passing \n `rustc -A unused-variables -D unused` denies everything in \n the `unused` lint group **including** `unused-variables` since \n the allow flag is specified before the deny flag (and therefore \n overridden).\n- rustc will now prefer your system MinGW libraries over its \n bundled libraries if they are available on `windows-gnu`.\n- rustc now buffers errors/warnings printed in JSON.\n\nLibraries:\n\n- `Arc\u003c[T; N]\u003e`, `Box\u003c[T; N]\u003e`, and `Rc\u003c[T; N]\u003e`, now implement \n `TryFrom\u003cArc\u003c[T]\u003e\u003e`,`TryFrom\u003cBox\u003c[T]\u003e\u003e`, and `TryFrom\u003cRc\u003c[T]\u003e\u003e`\n respectively.\n **Note** These conversions are only available when `N` is \n `0..=32`.\n- You can now use associated constants on floats and integers \n directly, rather than having to import the module.\n e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.\n- `u8::is_ascii` is now `const`.\n- `String` now implements `AsMut\u003cstr\u003e`.\n- Added the `primitive` module to `std` and `core`. \n This module reexports Rust\u0027s primitive types. This is mainly \n useful in macros where you want avoid these types being shadowed.\n- Relaxed some of the trait bounds on `HashMap` and `HashSet`.\n- `string::FromUtf8Error` now implements `Clone + Eq`.\n\n+ Stabilized APIs\n\n- `Once::is_completed`\n- `f32::LOG10_2`\n- `f32::LOG2_10`\n- `f64::LOG10_2`\n- `f64::LOG2_10`\n- `iter::once_with`\n\n+ Cargo\n\n - You can now set config `[profile]`s in your `.cargo/config`, \n or through your environment.\n - Cargo will now set `CARGO_BIN_EXE_\u003cname\u003e` pointing to a \n binary\u0027s executable path when running integration tests or \n benchmarks.\n `\u003cname\u003e` is the name of your binary as-is e.g. If you wanted \n the executable path for a binary named `my-program`you would \n use `env!(\u0027CARGO_BIN_EXE_my-program\u0027)`.\n\n+ Misc\n\n - Certain checks in the `const_err` lint were deemed unrelated \n to const evaluation, and have been moved to the \n `unconditional_panic` and `arithmetic_overflow` lints.\n\n+ Compatibility Notes\n\n - Having trailing syntax in the `assert!` macro is now a hard \n error. This has been a warning since 1.36.0.\n - Fixed `Self` not having the correctly inferred type. This \n incorrectly led to some instances being accepted, and now \n correctly emits a hard error.\n\nUpdate to version 1.42.0:\n\n+ Language\n\n - You can now use the slice pattern syntax with subslices.\n - You can now use #[repr(transparent)] on univariant enums. Meaning\n that you can create an enum that has the exact layout and ABI of\n the type it contains.\n - There are some syntax-only changes:\n * default is syntactically allowed before items in trait\n definitions.\n * Items in impls (i.e. consts, types, and fns) may syntactically\n leave out their bodies in favor of ;.\n * Bounds on associated types in impls are now syntactically\n allowed (e.g. type Foo: Ord;).\n * ... (the C-variadic type) may occur syntactically directly\n as the type of any function parameter.\n These are still rejected semantically, so you will likely receive\n an error but these changes can be seen and parsed by procedural\n macros and conditional compilation.\n\n+ Compiler\n\n - Added tier 2 support for armv7a-none-eabi.\n - Added tier 2 support for riscv64gc-unknown-linux-gnu.\n - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,\n unwrap_err} now produce panic messages pointing to the location\n where they were called, rather than core\u0027s internals.\n Refer to Rust\u0027s platform support page for more information on\n Rust\u0027s tiered platform support.\n\n+ Libraries\n\n - iter::Empty\u003cT\u003e now implements Send and Sync for any T.\n - Pin::{map_unchecked, map_unchecked_mut} no longer require the\n return type to implement Sized.\n - io::Cursor now derives PartialEq and Eq.\n - Layout::new is now const.\n - Added Standard Library support for riscv64gc-unknown-linux-gnu.\n\n+ Stabilized APIs\n\n - CondVar::wait_while\n - CondVar::wait_timeout_while\n - DebugMap::key\n - DebugMap::value\n - ManuallyDrop::take\n - matches!\n - ptr::slice_from_raw_parts_mut\n - ptr::slice_from_raw_parts\n\n+ Cargo\n\n - You no longer need to include extern crate proc_macro; to be\n able to use proc_macro; in the 2018 edition.\n\n+ Compatibility Notes\n\n - Error::description has been deprecated, and its use will now\n produce a warning. It\u0027s recommended to use Display/to_string\n instead.\n\nUpdate to version 1.41.1:\n\n - Always check types of static items\n - Always check lifetime bounds of `Copy` impls\n - Fix miscompilation in callers of `Layout::repeat`\n\nUpdate to version 1.41.0:\n\n+ Language\n\n - You can now pass type parameters to foreign items when implementing\n traits. E.g. You can now write `impl\u003cT\u003e From\u003cFoo\u003e for Vec\u003cT\u003e {}`.\n - You can now arbitrarily nest receiver types in the `self` position. E.g. you can\n now write `fn foo(self: Box\u003cBox\u003cSelf\u003e\u003e) {}`. Previously only `Self`, `\u0026Self`,\n `\u0026mut Self`, `Arc\u003cSelf\u003e`, `Rc\u003cSelf\u003e`, and `Box\u003cSelf\u003e` were allowed.\n - You can now use any valid identifier in a `format_args` macro.\n Previously identifiers starting with an underscore were not allowed.\n - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and\n enum variants. These are still rejected semantically, but\n can be seen and parsed by procedural macros and conditional compilation.\n \n+ Compiler\n\n - Rustc will now warn if you have unused loop `\u0027label`s.\n - Removed support for the `i686-unknown-dragonfly` target.\n - Added tier 3 support\\* for the `riscv64gc-unknown-linux-gnu` target.\n - You can now pass an arguments file passing the `@path` syntax\n to rustc. Note that the format differs somewhat from what is\n found in other tooling; please see the documentation for\n more information.\n - You can now provide `--extern` flag without a path, indicating that it is\n available from the search path or specified with an `-L` flag.\n \n Refer to Rust\u0027s [platform support page][forge-platform-support] for more\n information on Rust\u0027s tiered platform support.\n \n+ Libraries\n\n - The `core::panic` module is now stable. It was already stable\n through `std`.\n - `NonZero*` numerics now implement `From\u003cNonZero*\u003e` if it\u0027s a smaller integer\n width. E.g. `NonZeroU16` now implements `From\u003cNonZeroU8\u003e`.\n - `MaybeUninit\u003cT\u003e` now implements `fmt::Debug`.\n \n+ Stabilized APIs\n\n - `Result::map_or`\n - `Result::map_or_else`\n - `std::rc::Weak::weak_count`\n - `std::rc::Weak::strong_count`\n - `std::sync::Weak::weak_count`\n - `std::sync::Weak::strong_count`\n \n+ Cargo\n\n - Cargo will now document all the private items for binary crates\n by default.\n - `cargo-install` will now reinstall the package if it detects that it is out\n of date.\n - Cargo.lock now uses a more git friendly format that should help to reduce\n merge conflicts.\n - You can now override specific dependencies\u0027s build settings. E.g.\n `[profile.dev.package.image] opt-level = 2` sets the `image` crate\u0027s\n optimisation level to `2` for debug builds. You can also use\n `[profile.\u003cprofile\u003e.build-override]` to override build scripts and\n their dependencies.\n\n+ Misc\n\n - You can now specify `edition` in documentation code blocks to compile the block\n for that edition. E.g. `edition2018` tells rustdoc that the code sample\n should be compiled the 2018 edition of Rust.\n - You can now provide custom themes to rustdoc with `--theme`, and check the\n current theme with `--check-theme`.\n - You can use `#[cfg(doc)]` to compile an item when building documentation.\n \n+ Compatibility Notes\n\n - As previously announced 1.41.0 will be the last tier 1 release for 32-bit\n Apple targets. This means that the source code is still\n available to build, but the targets are no longer being tested and release\n binaries for those platforms will no longer be distributed by the Rust project.\n Please refer to the linked blog post for more information.\n\n- Bump version of libssh2 for SLE15; we now need a version with\n libssh2_userauth_publickey_frommemory(), which appeared in libssh2\n 1.6.0.\n\nUpdate to version 1.40.0\n\n+ Language\n\n - You can now use tuple `struct`s and tuple `enum` variant\u0027s constructors in\n `const` contexts. e.g.\n pub struct Point(i32, i32);\n const ORIGIN: Point = {\n let constructor = Point;\n constructor(0, 0)\n };\n - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to\n indicate that there may be variants or fields added in the future.\n For example this requires adding a wild-card branch (`_ =\u003e {}`) to any match\n statements on a non-exhaustive `enum`.\n - You can now use function-like procedural macros in `extern` blocks and in\n type positions. e.g. `type Generated = macro!();`\n - Function-like and attribute procedural macros can now emit\n `macro_rules!` items, so you can now have your macros generate macros.\n - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern\n attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,\n `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.\n\n+ Compiler\n\n - Added tier 3 support\\* for the\n `thumbv7neon-unknown-linux-musleabihf` target.\n - Added tier 3 support for the\n `aarch64-unknown-none-softfloat` target.\n - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and\n `mips64el-unknown-linux-muslabi64` targets.\n\n+ Libraries\n\n - The `is_power_of_two` method on unsigned numeric types is now a `const` function.\n\n+ Stabilized APIs\n\n - BTreeMap::get_key_value\n - HashMap::get_key_value\n - Option::as_deref_mut\n - Option::as_deref\n - Option::flatten\n - UdpSocket::peer_addr\n - f32::to_be_bytes\n - f32::to_le_bytes\n - f32::to_ne_bytes\n - f64::to_be_bytes\n - f64::to_le_bytes\n - f64::to_ne_bytes\n - f32::from_be_bytes\n - f32::from_le_bytes\n - f32::from_ne_bytes\n - f64::from_be_bytes\n - f64::from_le_bytes\n - f64::from_ne_bytes\n - mem::take\n - slice::repeat\n - todo!\n\n+ Cargo\n\n - Cargo will now always display warnings, rather than only on\n fresh builds.\n - Feature flags (except `--all-features`) passed to a virtual workspace will\n now produce an error. Previously these flags were ignored.\n - You can now publish `dev-dependencies` without including\n a `version`.\n\n+ Misc\n\n - You can now specify the `#[cfg(doctest)]` attribute to include an item only\n when running documentation tests with `rustdoc`.\n\n+ Compatibility Notes\n\n - As previously announced, any previous NLL warnings in the 2015 edition are\n now hard errors.\n - The `include!` macro will now warn if it failed to include the\n entire file. The `include!` macro unintentionally only includes the\n first _expression_ in a file, and this can be unintuitive. This will become\n either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.\n - Using `#[inline]` on function prototypes and consts now emits a warning under\n `unused_attribute` lint. Using `#[inline]` anywhere else inside traits\n or `extern` blocks now correctly emits a hard error.\n\nUpdate to version 1.39.0\n\n+ Language\n\n - You can now create async functions and blocks with async fn,\n async move {}, and async {} respectively, and you can now call\n .await on async expressions.\n - You can now use certain attributes on function, closure, and\n function pointer parameters.\n - You can now take shared references to bind-by-move patterns in\n the if guards of match arms.\n\n+ Compiler\n\n - Added tier 3 support for the i686-unknown-uefi target.\n - Added tier 3 support for the sparc64-unknown-openbsd target.\n - rustc will now trim code snippets in diagnostics to fit in your\n terminal.\n - You can now pass --show-output argument to test binaries to\n print the output of successful tests.\n\n+ For more details:\n https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07\n\n- Switch to bundled version of libgit2 for now. libgit2-sys seems\n to expect using the bundled variant, which just seems to point\n to a snapshot of the master branch and doesn\u0027t match any released\n libgit2 (bsc#1154817).\n See: https://github.com/rust-lang/rust/issues/63476 and\n https://github.com/rust-lang/git2-rs/issues/458 for details.\n\nUpdate to version 1.38.0\n\n+ Language\n\n - The `#[global_allocator]` attribute can now be used in submodules.\n - The `#[deprecated]` attribute can now be used on macros.\n\n+ Compiler\n\n - Added pipelined compilation support to `rustc`. This will\n improve compilation times in some cases.\n\n+ Libraries\n\n - `ascii::EscapeDefault` now implements `Clone` and `Display`.\n - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now\n available at the same path as the trait. (e.g. The `Clone` derive macro\n is available at `std::clone::Clone`). This also makes all built-in macros\n available in `std`/`core` root. e.g. `std::include_bytes!`.\n - `str::Chars` now implements `Debug`.\n - `slice::{concat, connect, join}` now accepts `\u0026[T]` in addition to `\u0026T`.\n - `*const T` and `*mut T` now implement `marker::Unpin`.\n - `Arc\u003c[T]\u003e` and `Rc\u003c[T]\u003e` now implement `FromIterator\u003cT\u003e`.\n - Added euclidean remainder and division operations (`div_euclid`,\n `rem_euclid`) to all numeric primitives. Additionally `checked`,\n `overflowing`, and `wrapping` versions are available for all\n integer primitives.\n - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and\n `PartialEq`.\n - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.\n\n+ Stabilized APIs\n\n - `\u003c*const T\u003e::cast`\n - `\u003c*mut T\u003e::cast`\n - `Duration::as_secs_f32`\n - `Duration::as_secs_f64`\n - `Duration::div_f32`\n - `Duration::div_f64`\n - `Duration::from_secs_f32`\n - `Duration::from_secs_f64`\n - `Duration::mul_f32`\n - `Duration::mul_f64`\n - `any::type_name`\n\n+ Cargo\n\n - Added pipelined compilation support to `cargo`.\n - You can now pass the `--features` option multiple times to enable\n multiple features.\n\n+ Misc\n\n - `rustc` will now warn about some incorrect uses of\n `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.\n\nUpdate to version 1.37.0\n\n + Language\n\n - #[must_use] will now warn if the type is contained in a tuple,\n Box, or an array and unused.\n - You can now use the `cfg` and `cfg_attr` attributes on\n generic parameters.\n - You can now use enum variants through type alias. e.g. You can\n write the following:\n ```\n type MyOption = Option\u003cu8\u003e;\n fn increment_or_zero(x: MyOption) -\u003e u8 {\n match x {\n MyOption::Some(y) =\u003e y + 1,\n MyOption::None =\u003e 0,\n }\n }\n ```\n - You can now use `_` as an identifier for consts. e.g. You can write\n `const _: u32 = 5;`.\n - You can now use `#[repr(align(X)]` on enums.\n - The `?` Kleene macro operator is now available in the\n 2015 edition.\n\n + Compiler\n\n - You can now enable Profile-Guided Optimization with the `-C profile-generate`\n and `-C profile-use` flags. For more information on how to use profile\n guided optimization, please refer to the rustc book.\n - The `rust-lldb` wrapper script should now work again.\n\n + Libraries\n\n - `mem::MaybeUninit\u003cT\u003e` is now ABI-compatible with `T`.\n\n + Stabilized APIs\n\n - BufReader::buffer\n - BufWriter::buffer\n - Cell::from_mut\n - Cell\u003c[T]\u003e::as_slice_of_cells\n - Cell\u003cslice\u003e::as_slice_of_cells\n - DoubleEndedIterator::nth_back\n - Option::xor\n - Wrapping::reverse_bits\n - i128::reverse_bits\n - i16::reverse_bits\n - i32::reverse_bits\n - i64::reverse_bits\n - i8::reverse_bits\n - isize::reverse_bits\n - slice::copy_within\n - u128::reverse_bits\n - u16::reverse_bits\n - u32::reverse_bits\n - u64::reverse_bits\n - u8::reverse_bits\n - usize::reverse_bits\n\n + Cargo\n\n - Cargo.lock files are now included by default when publishing executable crates\n with executables.\n - You can now specify `default-run=\u0027foo\u0027` in `[package]` to specify the\n default executable to use for `cargo run`.\n - cargo-vendor is now provided as a sub-command of cargo\n\n + Compatibility Notes\n\n - Using `...` for inclusive range patterns will now warn by default.\n Please transition your code to using the `..=` syntax for inclusive\n ranges instead.\n - Using a trait object without the `dyn` will now warn by default.\n Please transition your code to use `dyn Trait` for trait objects instead.\n Crab(String),\n Lobster(String),\n Person(String),\n let state = Creature::Crab(\u0027Ferris\u0027);\n if let Creature::Crab(name) | Creature::Person(name) = state {\n println!(\u0027This creature\u0027s name is: {}\u0027, name);\n }\n unsafe { foo() }\n pub fn new(x: i32, y: i32) -\u003e Self {\n Self(x, y)\n }\n pub fn is_origin(\u0026self) -\u003e bool {\n match self {\n Self(0, 0) =\u003e true,\n _ =\u003e false,\n }\n }\n Self: PartialOrd\u003cSelf\u003e // can write `Self` instead of `List\u003cT\u003e`\n Nil,\n Cons(T, Box\u003cSelf\u003e) // likewise here\n fn test(\u0026self) { println!(\u0027one\u0027); } //~ ERROR duplicate definitions with name `test`\n fn test(\u0026self) { println!(\u0027two\u0027); }\n\n* Basic procedural macros allowing custom `#[derive]`, aka \u0027macros 1.1\u0027, are\n stable. This allows popular code-generating crates like Serde and Diesel to\n work ergonomically. [RFC 1681].\n* [Tuple structs may be empty. Unary and empty tuple structs may be instantiated\n with curly braces][36868]. Part of [RFC 1506].\n* [A number of minor changes to name resolution have been activated][37127].\n They add up to more consistent semantics, allowing for future evolution of\n Rust macros. Specified in [RFC 1560], see its section on [\u0027changes\u0027] for\n details of what is different. The breaking changes here have been transitioned\n through the [`legacy_imports`] lint since 1.14, with no known regressions.\n* [In `macro_rules`, `path` fragments can now be parsed as type parameter\n bounds][38279]\n* [`?Sized` can be used in `where` clauses][37791]\n* [There is now a limit on the size of monomorphized types and it can be\n modified with the `#![type_size_limit]` crate attribute, similarly to\n the `#![recursion_limit]` attribute][37789]\n* [On Windows, the compiler will apply dllimport attributes when linking to\n extern functions][37973]. Additional attributes and flags can control which\n library kind is linked and its name. [RFC 1717].\n* [Rust-ABI symbols are no longer exported from cdylibs][38117]\n* [The `--test` flag works with procedural macro crates][38107]\n* [Fix `extern \u0027aapcs\u0027 fn` ABI][37814]\n* [The `-C no-stack-check` flag is deprecated][37636]. It does nothing.\n* [The `format!` expander recognizes incorrect `printf` and shell-style\n formatting directives and suggests the correct format][37613].\n* [Only report one error for all unused imports in an import list][37456]\n* [Avoid unnecessary `mk_ty` calls in `Ty::super_fold_with`][37705]\n* [Avoid more unnecessary `mk_ty` calls in `Ty::super_fold_with`][37979]\n* [Don\u0027t clone in `UnificationTable::probe`][37848]\n* [Remove `scope_auxiliary` to cut RSS by 10%][37764]\n* [Use small vectors in type walker][37760]\n* [Macro expansion performance was improved][37701]\n* [Change `HirVec\u003cP\u003cT\u003e\u003e` to `HirVec\u003cT\u003e` in `hir::Expr`][37642]\n* [Replace FNV with a faster hash function][37229]\n https://raw.githubusercontent.com/rust-lang/rust/master/RELEASES.md\n\nrust-cbindgen is shipped in version 0.14.1.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-945",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0945-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:0945-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7Z5FNEN6ESZTK5WIFX2ODDNYYHFYUJ3Z/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:0945-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7Z5FNEN6ESZTK5WIFX2ODDNYYHFYUJ3Z/"
},
{
"category": "self",
"summary": "SUSE Bug 1115645",
"url": "https://bugzilla.suse.com/1115645"
},
{
"category": "self",
"summary": "SUSE Bug 1154817",
"url": "https://bugzilla.suse.com/1154817"
},
{
"category": "self",
"summary": "SUSE Bug 1173202",
"url": "https://bugzilla.suse.com/1173202"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-1967 page",
"url": "https://www.suse.com/security/cve/CVE-2020-1967/"
}
],
"title": "Security update for rust, rust-cbindgen",
"tracking": {
"current_release_date": "2020-07-07T05:51:07Z",
"generator": {
"date": "2020-07-07T05:51:07Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:0945-1",
"initial_release_date": "2020-07-07T05:51:07Z",
"revision_history": [
{
"date": "2020-07-07T05:51:07Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cargo-1.43.1-lp152.3.5.1.i586",
"product": {
"name": "cargo-1.43.1-lp152.3.5.1.i586",
"product_id": "cargo-1.43.1-lp152.3.5.1.i586"
}
},
{
"category": "product_version",
"name": "clippy-1.43.1-lp152.3.5.1.i586",
"product": {
"name": "clippy-1.43.1-lp152.3.5.1.i586",
"product_id": "clippy-1.43.1-lp152.3.5.1.i586"
}
},
{
"category": "product_version",
"name": "rls-1.43.1-lp152.3.5.1.i586",
"product": {
"name": "rls-1.43.1-lp152.3.5.1.i586",
"product_id": "rls-1.43.1-lp152.3.5.1.i586"
}
},
{
"category": "product_version",
"name": "rust-1.43.1-lp152.3.5.1.i586",
"product": {
"name": "rust-1.43.1-lp152.3.5.1.i586",
"product_id": "rust-1.43.1-lp152.3.5.1.i586"
}
},
{
"category": "product_version",
"name": "rust-analysis-1.43.1-lp152.3.5.1.i586",
"product": {
"name": "rust-analysis-1.43.1-lp152.3.5.1.i586",
"product_id": "rust-analysis-1.43.1-lp152.3.5.1.i586"
}
},
{
"category": "product_version",
"name": "rust-doc-1.43.1-lp152.3.5.1.i586",
"product": {
"name": "rust-doc-1.43.1-lp152.3.5.1.i586",
"product_id": "rust-doc-1.43.1-lp152.3.5.1.i586"
}
},
{
"category": "product_version",
"name": "rust-gdb-1.43.1-lp152.3.5.1.i586",
"product": {
"name": "rust-gdb-1.43.1-lp152.3.5.1.i586",
"product_id": "rust-gdb-1.43.1-lp152.3.5.1.i586"
}
},
{
"category": "product_version",
"name": "rust-std-static-1.43.1-lp152.3.5.1.i586",
"product": {
"name": "rust-std-static-1.43.1-lp152.3.5.1.i586",
"product_id": "rust-std-static-1.43.1-lp152.3.5.1.i586"
}
},
{
"category": "product_version",
"name": "rustfmt-1.43.1-lp152.3.5.1.i586",
"product": {
"name": "rustfmt-1.43.1-lp152.3.5.1.i586",
"product_id": "rustfmt-1.43.1-lp152.3.5.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "cargo-doc-1.43.1-lp152.3.5.1.noarch",
"product": {
"name": "cargo-doc-1.43.1-lp152.3.5.1.noarch",
"product_id": "cargo-doc-1.43.1-lp152.3.5.1.noarch"
}
},
{
"category": "product_version",
"name": "rust-src-1.43.1-lp152.3.5.1.noarch",
"product": {
"name": "rust-src-1.43.1-lp152.3.5.1.noarch",
"product_id": "rust-src-1.43.1-lp152.3.5.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cargo-1.43.1-lp152.3.5.1.x86_64",
"product": {
"name": "cargo-1.43.1-lp152.3.5.1.x86_64",
"product_id": "cargo-1.43.1-lp152.3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "clippy-1.43.1-lp152.3.5.1.x86_64",
"product": {
"name": "clippy-1.43.1-lp152.3.5.1.x86_64",
"product_id": "clippy-1.43.1-lp152.3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "rls-1.43.1-lp152.3.5.1.x86_64",
"product": {
"name": "rls-1.43.1-lp152.3.5.1.x86_64",
"product_id": "rls-1.43.1-lp152.3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-1.43.1-lp152.3.5.1.x86_64",
"product": {
"name": "rust-1.43.1-lp152.3.5.1.x86_64",
"product_id": "rust-1.43.1-lp152.3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-analysis-1.43.1-lp152.3.5.1.x86_64",
"product": {
"name": "rust-analysis-1.43.1-lp152.3.5.1.x86_64",
"product_id": "rust-analysis-1.43.1-lp152.3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-cbindgen-0.14.1-lp152.2.4.1.x86_64",
"product": {
"name": "rust-cbindgen-0.14.1-lp152.2.4.1.x86_64",
"product_id": "rust-cbindgen-0.14.1-lp152.2.4.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-doc-1.43.1-lp152.3.5.1.x86_64",
"product": {
"name": "rust-doc-1.43.1-lp152.3.5.1.x86_64",
"product_id": "rust-doc-1.43.1-lp152.3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-gdb-1.43.1-lp152.3.5.1.x86_64",
"product": {
"name": "rust-gdb-1.43.1-lp152.3.5.1.x86_64",
"product_id": "rust-gdb-1.43.1-lp152.3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "rust-std-static-1.43.1-lp152.3.5.1.x86_64",
"product": {
"name": "rust-std-static-1.43.1-lp152.3.5.1.x86_64",
"product_id": "rust-std-static-1.43.1-lp152.3.5.1.x86_64"
}
},
{
"category": "product_version",
"name": "rustfmt-1.43.1-lp152.3.5.1.x86_64",
"product": {
"name": "rustfmt-1.43.1-lp152.3.5.1.x86_64",
"product_id": "rustfmt-1.43.1-lp152.3.5.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.2",
"product": {
"name": "openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cargo-1.43.1-lp152.3.5.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.i586"
},
"product_reference": "cargo-1.43.1-lp152.3.5.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cargo-1.43.1-lp152.3.5.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.x86_64"
},
"product_reference": "cargo-1.43.1-lp152.3.5.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cargo-doc-1.43.1-lp152.3.5.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cargo-doc-1.43.1-lp152.3.5.1.noarch"
},
"product_reference": "cargo-doc-1.43.1-lp152.3.5.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "clippy-1.43.1-lp152.3.5.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.i586"
},
"product_reference": "clippy-1.43.1-lp152.3.5.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "clippy-1.43.1-lp152.3.5.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.x86_64"
},
"product_reference": "clippy-1.43.1-lp152.3.5.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rls-1.43.1-lp152.3.5.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.i586"
},
"product_reference": "rls-1.43.1-lp152.3.5.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rls-1.43.1-lp152.3.5.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.x86_64"
},
"product_reference": "rls-1.43.1-lp152.3.5.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-1.43.1-lp152.3.5.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.i586"
},
"product_reference": "rust-1.43.1-lp152.3.5.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-1.43.1-lp152.3.5.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.x86_64"
},
"product_reference": "rust-1.43.1-lp152.3.5.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-analysis-1.43.1-lp152.3.5.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.i586"
},
"product_reference": "rust-analysis-1.43.1-lp152.3.5.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-analysis-1.43.1-lp152.3.5.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.x86_64"
},
"product_reference": "rust-analysis-1.43.1-lp152.3.5.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-cbindgen-0.14.1-lp152.2.4.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-cbindgen-0.14.1-lp152.2.4.1.x86_64"
},
"product_reference": "rust-cbindgen-0.14.1-lp152.2.4.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-doc-1.43.1-lp152.3.5.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.i586"
},
"product_reference": "rust-doc-1.43.1-lp152.3.5.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-doc-1.43.1-lp152.3.5.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.x86_64"
},
"product_reference": "rust-doc-1.43.1-lp152.3.5.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-gdb-1.43.1-lp152.3.5.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.i586"
},
"product_reference": "rust-gdb-1.43.1-lp152.3.5.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-gdb-1.43.1-lp152.3.5.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.x86_64"
},
"product_reference": "rust-gdb-1.43.1-lp152.3.5.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-src-1.43.1-lp152.3.5.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-src-1.43.1-lp152.3.5.1.noarch"
},
"product_reference": "rust-src-1.43.1-lp152.3.5.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-std-static-1.43.1-lp152.3.5.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.i586"
},
"product_reference": "rust-std-static-1.43.1-lp152.3.5.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rust-std-static-1.43.1-lp152.3.5.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.x86_64"
},
"product_reference": "rust-std-static-1.43.1-lp152.3.5.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rustfmt-1.43.1-lp152.3.5.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.i586"
},
"product_reference": "rustfmt-1.43.1-lp152.3.5.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rustfmt-1.43.1-lp152.3.5.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.x86_64"
},
"product_reference": "rustfmt-1.43.1-lp152.3.5.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-1967",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-1967"
}
],
"notes": [
{
"category": "general",
"text": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:cargo-doc-1.43.1-lp152.3.5.1.noarch",
"openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-cbindgen-0.14.1-lp152.2.4.1.x86_64",
"openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-src-1.43.1-lp152.3.5.1.noarch",
"openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-1967",
"url": "https://www.suse.com/security/cve/CVE-2020-1967"
},
{
"category": "external",
"summary": "SUSE Bug 1169407 for CVE-2020-1967",
"url": "https://bugzilla.suse.com/1169407"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:cargo-doc-1.43.1-lp152.3.5.1.noarch",
"openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-cbindgen-0.14.1-lp152.2.4.1.x86_64",
"openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-src-1.43.1-lp152.3.5.1.noarch",
"openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:cargo-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:cargo-doc-1.43.1-lp152.3.5.1.noarch",
"openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:clippy-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rls-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-analysis-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-cbindgen-0.14.1-lp152.2.4.1.x86_64",
"openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-doc-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-gdb-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rust-src-1.43.1-lp152.3.5.1.noarch",
"openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rust-std-static-1.43.1-lp152.3.5.1.x86_64",
"openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.i586",
"openSUSE Leap 15.2:rustfmt-1.43.1-lp152.3.5.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-07T05:51:07Z",
"details": "important"
}
],
"title": "CVE-2020-1967"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…