{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below.\n\nSiemens has released a new version of SIDIS Prime and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html"
      },
      {
        "category": "self",
        "summary": "SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-485750.json"
      }
    ],
    "title": "SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800",
    "tracking": {
      "current_release_date": "2026-03-10T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-485750",
      "initial_release_date": "2026-03-10T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-03-10T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c4.0.800",
                "product": {
                  "name": "SIDIS Prime",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SIDIS Prime"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-29857",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-29857"
    },
    {
      "cve": "CVE-2024-30171",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-30171"
    },
    {
      "cve": "CVE-2024-30172",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-30172"
    },
    {
      "cve": "CVE-2024-41996",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-41996"
    },
    {
      "cve": "CVE-2025-6965",
      "cwe": {
        "id": "CWE-197",
        "name": "Numeric Truncation Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-6965"
    },
    {
      "cve": "CVE-2025-7783",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\r\n\r\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-7783"
    },
    {
      "cve": "CVE-2025-9230",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-9230"
    },
    {
      "cve": "CVE-2025-9232",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the \u0027no_proxy\u0027 environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na \u0027no_proxy\u0027 environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-9232"
    },
    {
      "cve": "CVE-2025-9670",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-9670"
    },
    {
      "cve": "CVE-2025-12816",
      "cwe": {
        "id": "CWE-436",
        "name": "Interpretation Conflict"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-12816"
    },
    {
      "cve": "CVE-2025-15284",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummaryThe arrayLimit\u00a0option in qs does not enforce limits for bracket notation (a[]=1\u0026a[]=2), allowing attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimit\u00a0for DoS protection are vulnerable.\n\nDetailsThe arrayLimit\u00a0option only checks limits for indexed notation (a[0]=1\u0026a[1]=2) but completely bypasses it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code\u00a0(lib/parse.js:159-162):\n\nif (root === \u0027[]\u0027 \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code\u00a0(lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf)\u00a0without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit\u00a0before creating arrays.\n\nPoCTest 1 - Basic bypass:\n\nnpm install qs\n\n\n\n\n\nconst qs = require(\u0027qs\u0027);\nconst result = qs.parse(\u0027a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6\u0027, { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nTest 2 - DoS demonstration:\n\nconst qs = require(\u0027qs\u0027);\nconst attack = \u0027a[]=\u0027 + Array(10000).fill(\u0027x\u0027).join(\u0027\u0026a[]=\u0027);\nconst result = qs.parse(attack, { arrayLimit: 100 });\nconsole.log(result.a.length);  // Output: 10000 (should be max 100)\n\n\n\n\n\nConfiguration:\n\n  *  arrayLimit: 5\u00a0(test 1) or arrayLimit: 100\u00a0(test 2)\n  *  Use bracket notation: a[]=value\u00a0(not indexed a[0]=value)\n\n\nImpactDenial of Service via memory exhaustion. Affects applications using qs.parse()\u00a0with user-controlled input and arrayLimit\u00a0for protection.\n\nAttack scenario:\n\n  *  Attacker sends HTTP request: GET /api/search?filters[]=x\u0026filters[]=x\u0026...\u0026filters[]=x\u00a0(100,000+ times)\n  *  Application parses with qs.parse(query, { arrayLimit: 100 })\n  *  qs ignores limit, parses all 100,000 elements into array\n  *  Server memory exhausted \u2192 application crashes or becomes unresponsive\n  *  Service unavailable for all users\nReal-world impact:\n\n  *  Single malicious request can crash server\n  *  No authentication required\n  *  Easy to automate and scale\n  *  Affects any endpoint parsing query strings with bracket notation",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2025-58751",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-58751"
    },
    {
      "cve": "CVE-2025-58752",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: \u0027spa\u0027` (default) or `appType: \u0027mpa\u0027` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-58752"
    },
    {
      "cve": "CVE-2025-58754",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: \u0027stream\u0027`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-58754"
    },
    {
      "cve": "CVE-2025-62522",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-62522"
    },
    {
      "cve": "CVE-2025-64718",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it\u0027s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-64718"
    },
    {
      "cve": "CVE-2025-64756",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c \u003ccommand\u003e \u003cpatterns\u003e are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-64756"
    },
    {
      "cve": "CVE-2025-66030",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66030"
    },
    {
      "cve": "CVE-2025-66031",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66031"
    },
    {
      "cve": "CVE-2025-66035",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular\u0027s HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66035"
    },
    {
      "cve": "CVE-2025-66412",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler\u0027s internal security schema is incomplete, allowing attackers to bypass Angular\u0027s built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66412"
    },
    {
      "cve": "CVE-2025-69277",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "notes": [
        {
          "category": "summary",
          "text": "libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0027t in the main cryptographic group.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-69277"
    },
    {
      "cve": "CVE-2026-22610",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular\u2019s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG \u003cscript\u003e elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2026-22610"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Bouncy Castle ist eine Kryptographie-API f\u00fcr Java.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein anonymer Angreifer kann mehrere Schwachstellen in Bouncy Castle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen DNS-Poisoning-Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1031 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1031.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1031 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1031"
      },
      {
        "category": "external",
        "summary": "Bouncy Castle Release Notes vom 2024-05-05",
        "url": "https://www.bouncycastle.org/latest_releases.html#LATEST"
      },
      {
        "category": "external",
        "summary": "Red Hat Bugzilla vom 2024-05-05",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279227"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2024-05-05",
        "url": "https://github.com/advisories/GHSA-4h8f-2wvx-gg5w"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:1539-1 vom 2024-05-11",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/QZZU3EK7MCVS5TGBQL47TPFRCL6XR25J/"
      },
      {
        "category": "external",
        "summary": "PDFreactor 11 Hotfix Release vom 2024-06-13",
        "url": "https://www.pdfreactor.com/pdfreactor-11-hotfix-release-11-6-12-now-available/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:1539-2 vom 2024-06-18",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NCEDYUZRBIYFFW6ATWOW33BSWPBY2U52/"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7158960 vom 2024-06-27",
        "url": "https://www.ibm.com/support/pages/node/7158960"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:4271 vom 2024-07-03",
        "url": "https://access.redhat.com/errata/RHSA-2024:4271"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:4173 vom 2024-07-08",
        "url": "https://access.redhat.com/errata/RHSA-2024:4173"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7159714 vom 2024-07-05",
        "url": "https://www.ibm.com/support/pages/node/7159714"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:4505 vom 2024-07-11",
        "url": "https://access.redhat.com/errata/RHSA-2024:4505"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7160134 vom 2024-07-12",
        "url": "https://www.ibm.com/support/pages/node/7160134"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:4326 vom 2024-07-14",
        "url": "https://access.redhat.com/errata/RHSA-2024:4326"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:4884 vom 2024-07-26",
        "url": "https://access.redhat.com/errata/RHSA-2024:4884"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:5143 vom 2024-08-09",
        "url": "https://access.redhat.com/errata/RHSA-2024:5143"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:5144 vom 2024-08-09",
        "url": "https://access.redhat.com/errata/RHSA-2024:5144"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:5147 vom 2024-08-09",
        "url": "https://access.redhat.com/errata/RHSA-2024:5147"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:5145 vom 2024-08-09",
        "url": "https://access.redhat.com/errata/RHSA-2024:5145"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7165340 vom 2024-08-13",
        "url": "https://www.ibm.com/support/pages/node/7165340"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:5482 vom 2024-08-16",
        "url": "https://access.redhat.com/errata/RHSA-2024:5482"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:5481 vom 2024-08-16",
        "url": "https://access.redhat.com/errata/RHSA-2024:5481"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:5479 vom 2024-08-16",
        "url": "https://access.redhat.com/errata/RHSA-2024:5479"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7166617 vom 2024-08-26",
        "url": "https://www.ibm.com/support/pages/node/7166617"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7167111 vom 2024-09-03",
        "url": "https://www.ibm.com/support/pages/node/7167111"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7168235 vom 2024-09-12",
        "url": "https://www.ibm.com/support/pages/node/7168235"
      },
      {
        "category": "external",
        "summary": "Confluence Data Center Advisory",
        "url": "https://jira.atlassian.com/browse/CONFSERVER-97723"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7168754 vom 2024-09-17",
        "url": "https://www.ibm.com/support/pages/node/7168754"
      },
      {
        "category": "external",
        "summary": "Atlassian November 2024 Security Bulletin vom 2024-11-19",
        "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1456179091"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20241206-0008 vom 2024-12-06",
        "url": "https://security.netapp.com/advisory/ntap-20241206-0008/"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2024-152 vom 2024-12-17",
        "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-152/index.html"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Bulletin",
        "url": "https://confluence.atlassian.com/security/security-bulletin-march-18-2025-1527943363.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7229444 vom 2025-03-28",
        "url": "https://www.ibm.com/support/pages/node/7229444"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20240614-0007 vom 2025-07-02",
        "url": "https://security.netapp.com/advisory/NTAP-20240614-0007"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20240614-0008 vom 2025-08-20",
        "url": "https://security.netapp.com/advisory/NTAP-20240614-0008"
      },
      {
        "category": "external",
        "summary": "SAS Security Update vom 2025-10-02",
        "url": "https://support.sas.com/en/security-bulletins/sas-security-update-for-sas-94m9-ts1m9.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-8108-1 vom 2026-03-18",
        "url": "https://ubuntu.com/security/notices/USN-8108-1"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2026-152 vom 2026-03-23",
        "url": "https://www.dell.com/support/kbdoc/de-de/000443243/dsa-2026-152-dell-secure-connect-gateway-security-update-for-multiple-third-party-component-vulnerabilities"
      }
    ],
    "source_lang": "en-US",
    "title": "Bouncy Castle: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-23T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-24T10:23:44.286+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2024-1031",
      "initial_release_date": "2024-05-05T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-05-05T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-05-12T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-06-12T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2024-06-18T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-06-26T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-07-02T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-07-07T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat und IBM aufgenommen"
        },
        {
          "date": "2024-07-11T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-07-14T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-07-25T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-08-08T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-08-13T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-08-15T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-08-25T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-09-03T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-09-11T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-09-17T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-11-19T23:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2024-12-05T23:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2024-12-17T23:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2025-03-18T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Atlassian aufgenommen"
        },
        {
          "date": "2025-03-30T22:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-07-01T22:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2025-08-19T22:00:00.000+00:00",
          "number": "24",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2025-10-05T22:00:00.000+00:00",
          "number": "25",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2026-03-18T23:00:00.000+00:00",
          "number": "26",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2026-03-23T23:00:00.000+00:00",
          "number": "27",
          "summary": "Neue Updates von Dell aufgenommen"
        }
      ],
      "status": "final",
      "version": "27"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Atlassian Bitbucket",
                "product": {
                  "name": "Atlassian Bitbucket",
                  "product_id": "T021356",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:-"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.5.2",
                "product": {
                  "name": "Atlassian Bitbucket \u003c9.5.2",
                  "product_id": "T041970"
                }
              },
              {
                "category": "product_version",
                "name": "9.5.2",
                "product": {
                  "name": "Atlassian Bitbucket 9.5.2",
                  "product_id": "T041970-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:9.5.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.4.4",
                "product": {
                  "name": "Atlassian Bitbucket \u003c9.4.4",
                  "product_id": "T041971"
                }
              },
              {
                "category": "product_version",
                "name": "9.4.4",
                "product": {
                  "name": "Atlassian Bitbucket 9.4.4",
                  "product_id": "T041971-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:9.4.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.19.16",
                "product": {
                  "name": "Atlassian Bitbucket \u003c8.19.16",
                  "product_id": "T041972"
                }
              },
              {
                "category": "product_version",
                "name": "8.19.16",
                "product": {
                  "name": "Atlassian Bitbucket 8.19.16",
                  "product_id": "T041972-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:8.19.16"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.9.26",
                "product": {
                  "name": "Atlassian Bitbucket \u003c8.9.26",
                  "product_id": "T041973"
                }
              },
              {
                "category": "product_version",
                "name": "8.9.26",
                "product": {
                  "name": "Atlassian Bitbucket 8.9.26",
                  "product_id": "T041973-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:8.9.26"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bitbucket"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.9.4",
                "product": {
                  "name": "Atlassian Confluence \u003c8.9.4",
                  "product_id": "T036294"
                }
              },
              {
                "category": "product_version",
                "name": "8.9.4",
                "product": {
                  "name": "Atlassian Confluence 8.9.4",
                  "product_id": "T036294-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:data_center__8.9.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.5.12",
                "product": {
                  "name": "Atlassian Confluence \u003c8.5.12",
                  "product_id": "T036295"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.12",
                "product": {
                  "name": "Atlassian Confluence 8.5.12",
                  "product_id": "T036295-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:data_center_and_server__8.5.12"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.0.1",
                "product": {
                  "name": "Atlassian Confluence \u003c9.0.1",
                  "product_id": "T036970"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.1",
                "product": {
                  "name": "Atlassian Confluence 9.0.1",
                  "product_id": "T036970-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:9.0.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.19.26",
                "product": {
                  "name": "Atlassian Confluence \u003c7.19.26",
                  "product_id": "T036972"
                }
              },
              {
                "category": "product_version",
                "name": "7.19.26",
                "product": {
                  "name": "Atlassian Confluence 7.19.26",
                  "product_id": "T036972-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:7.19.26"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Confluence"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.34.00.16",
                "product": {
                  "name": "Dell Secure Connect Gateway \u003c5.34.00.16",
                  "product_id": "T052048"
                }
              },
              {
                "category": "product_version",
                "name": "5.34.00.16",
                "product": {
                  "name": "Dell Secure Connect Gateway 5.34.00.16",
                  "product_id": "T052048-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:dell:secure_connect_gateway:5.34.00.16"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Secure Connect Gateway"
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Hitachi Ops Center",
            "product": {
              "name": "Hitachi Ops Center",
              "product_id": "T017562",
              "product_identification_helper": {
                "cpe": "cpe:/a:hitachi:ops_center:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Hitachi"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM DB2",
            "product": {
              "name": "IBM DB2",
              "product_id": "5104",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:db2:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.2",
                "product": {
                  "name": "IBM License Metric Tool 9.2",
                  "product_id": "T031605",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:license_metric_tool:9.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "License Metric Tool"
          },
          {
            "category": "product_name",
            "name": "IBM MQ",
            "product": {
              "name": "IBM MQ",
              "product_id": "T021398",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:mq:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.5.0 UP9",
                "product": {
                  "name": "IBM QRadar SIEM \u003c7.5.0 UP9",
                  "product_id": "T036127"
                }
              },
              {
                "category": "product_version",
                "name": "7.5.0 UP9",
                "product": {
                  "name": "IBM QRadar SIEM 7.5.0 UP9",
                  "product_id": "T036127-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up9"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "QRadar SIEM"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Collaboration and Deployment Services 8.5",
                "product": {
                  "name": "IBM SPSS Collaboration and Deployment Services 8.5",
                  "product_id": "T038750",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spss:collaboration_and_deployment_services_8.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SPSS"
          },
          {
            "category": "product_name",
            "name": "IBM Security Guardium",
            "product": {
              "name": "IBM Security Guardium",
              "product_id": "T021345",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:security_guardium:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.2.1.0",
                "product": {
                  "name": "IBM Storage Scale \u003c5.2.1.0",
                  "product_id": "T037080"
                }
              },
              {
                "category": "product_version",
                "name": "5.2.1.0",
                "product": {
                  "name": "IBM Storage Scale 5.2.1.0",
                  "product_id": "T037080-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_scale:5.2.1.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c5.1.9.5",
                "product": {
                  "name": "IBM Storage Scale \u003c5.1.9.5",
                  "product_id": "T037081"
                }
              },
              {
                "category": "product_version",
                "name": "5.1.9.5",
                "product": {
                  "name": "IBM Storage Scale 5.1.9.5",
                  "product_id": "T037081-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_scale:5.1.9.5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5.1.0.0-5.1.9.4",
                "product": {
                  "name": "IBM Storage Scale 5.1.0.0-5.1.9.4",
                  "product_id": "T037717",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_scale:5.1.0.0_-_5.1.9.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Storage Scale"
          },
          {
            "category": "product_name",
            "name": "IBM Tivoli Key Lifecycle Manager",
            "product": {
              "name": "IBM Tivoli Key Lifecycle Manager",
              "product_id": "T026238",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:tivoli_key_lifecycle_manager:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "for Linux",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager for Linux",
                  "product_id": "T023548",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:for_linux"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "for VMware vSphere",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager for VMware vSphere",
                  "product_id": "T025152",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "for Microsoft Windows",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager for Microsoft Windows",
                  "product_id": "T025631",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "NetApp ActiveIQ Unified Manager",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager",
                  "product_id": "T032260",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ActiveIQ Unified Manager"
          }
        ],
        "category": "vendor",
        "name": "NetApp"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.78.1",
                "product": {
                  "name": "Open Source Bouncy Castle \u003c1.78.1",
                  "product_id": "T034537"
                }
              },
              {
                "category": "product_version",
                "name": "1.78.1",
                "product": {
                  "name": "Open Source Bouncy Castle 1.78.1",
                  "product_id": "T034537-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.78.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bouncy Castle"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c11.6.12",
                "product": {
                  "name": "RealObjects PDFreactor \u003c11.6.12",
                  "product_id": "T035425"
                }
              },
              {
                "category": "product_version",
                "name": "11.6.12",
                "product": {
                  "name": "RealObjects PDFreactor 11.6.12",
                  "product_id": "T035425-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:realobjects:pdfreactor:11.6.12"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PDFreactor"
          }
        ],
        "category": "vendor",
        "name": "RealObjects"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.4M9 (TS1M9)",
                "product": {
                  "name": "SAS Institute Base SAS \u003c9.4M9 (TS1M9)",
                  "product_id": "T047382"
                }
              },
              {
                "category": "product_version",
                "name": "9.4M9 (TS1M9)",
                "product": {
                  "name": "SAS Institute Base SAS 9.4M9 (TS1M9)",
                  "product_id": "T047382-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sas:base_sas:9.4m9_%28ts1m9%29"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Base SAS"
          }
        ],
        "category": "vendor",
        "name": "SAS Institute"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-29857",
      "product_status": {
        "known_affected": [
          "T037717",
          "T025152",
          "T047382",
          "67646",
          "T032260",
          "T036127",
          "T021356",
          "T025631",
          "T031605",
          "T021398",
          "T035425",
          "T034537",
          "T036972",
          "T038750",
          "T052048",
          "T017562",
          "T036970",
          "T023548",
          "T021345",
          "T036294",
          "T036295",
          "T002207",
          "T037080",
          "T037081",
          "T000126",
          "5104",
          "T026238",
          "T041973",
          "T041972",
          "T041971",
          "T041970"
        ]
      },
      "release_date": "2024-05-05T22:00:00.000+00:00",
      "title": "CVE-2024-29857"
    },
    {
      "cve": "CVE-2024-30171",
      "product_status": {
        "known_affected": [
          "T037717",
          "T025152",
          "T047382",
          "67646",
          "T032260",
          "T036127",
          "T021356",
          "T025631",
          "T031605",
          "T021398",
          "T035425",
          "T034537",
          "T036972",
          "T038750",
          "T052048",
          "T017562",
          "T036970",
          "T023548",
          "T021345",
          "T036294",
          "T036295",
          "T002207",
          "T037080",
          "T037081",
          "T000126",
          "5104",
          "T026238",
          "T041973",
          "T041972",
          "T041971",
          "T041970"
        ]
      },
      "release_date": "2024-05-05T22:00:00.000+00:00",
      "title": "CVE-2024-30171"
    },
    {
      "cve": "CVE-2024-30172",
      "product_status": {
        "known_affected": [
          "T037717",
          "T025152",
          "T047382",
          "67646",
          "T032260",
          "T036127",
          "T021356",
          "T025631",
          "T031605",
          "T021398",
          "T035425",
          "T034537",
          "T036972",
          "T038750",
          "T052048",
          "T017562",
          "T036970",
          "T023548",
          "T021345",
          "T036294",
          "T036295",
          "T002207",
          "T037080",
          "T037081",
          "T000126",
          "5104",
          "T026238",
          "T041973",
          "T041972",
          "T041971",
          "T041970"
        ]
      },
      "release_date": "2024-05-05T22:00:00.000+00:00",
      "title": "CVE-2024-30172"
    },
    {
      "cve": "CVE-2024-34447",
      "product_status": {
        "known_affected": [
          "T037717",
          "T025152",
          "T047382",
          "67646",
          "T032260",
          "T036127",
          "T021356",
          "T025631",
          "T031605",
          "T021398",
          "T035425",
          "T034537",
          "T036972",
          "T038750",
          "T052048",
          "T017562",
          "T036970",
          "T023548",
          "T021345",
          "T036294",
          "T036295",
          "T002207",
          "T037080",
          "T037081",
          "T000126",
          "5104",
          "T026238",
          "T041973",
          "T041972",
          "T041971",
          "T041970"
        ]
      },
      "release_date": "2024-05-05T22:00:00.000+00:00",
      "title": "CVE-2024-34447"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Der JobScheduler ist eine Open-Source-L\u00f6sung f\u00fcr die Prozessautomatisierung auf Unternehmensebene.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SOS GmbH JobScheduler ausnutzen, um Daten zu ver\u00e4ndern, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1912 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1912.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1912 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1912"
      },
      {
        "category": "external",
        "summary": "JobScheduler Vulnerability Remediation Release 2.7.2 vom 2024-08-22",
        "url": "https://kb.sos-berlin.com/display/PKB/Vulnerability+Remediation+Release+2.7.2"
      },
      {
        "category": "external",
        "summary": "JobScheduler Vulnerability Remediation Release 2.6.7 vom 2024-08-22",
        "url": "https://kb.sos-berlin.com/display/PKB/Vulnerability+Remediation+Release+2.6.7"
      },
      {
        "category": "external",
        "summary": "JobScheduler Vulnerability Remediation Release 2.5.10 vom 2024-08-22",
        "url": "https://kb.sos-berlin.com/display/PKB/Vulnerability+Remediation+Release+2.5.10"
      },
      {
        "category": "external",
        "summary": "JobScheduler Issue JS-2130 vom 2024-08-22",
        "url": "https://change.sos-berlin.com/browse/JS-2130"
      },
      {
        "category": "external",
        "summary": "JobScheduler Issue JOC-1889 vom 2024-08-22",
        "url": "https://change.sos-berlin.com/browse/JOC-1889"
      }
    ],
    "source_lang": "en-US",
    "title": "SOS GmbH JobScheduler: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-08-22T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-23T09:36:17.623+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-1912",
      "initial_release_date": "2024-08-22T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-08-22T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.7.2",
                "product": {
                  "name": "SOS GmbH JobScheduler \u003c2.7.2",
                  "product_id": "T037040"
                }
              },
              {
                "category": "product_version",
                "name": "2.7.2",
                "product": {
                  "name": "SOS GmbH JobScheduler 2.7.2",
                  "product_id": "T037040-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sos_gmbh:jobscheduler:2.7.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2.5.10",
                "product": {
                  "name": "SOS GmbH JobScheduler \u003c2.5.10",
                  "product_id": "T037041"
                }
              },
              {
                "category": "product_version",
                "name": "2.5.10",
                "product": {
                  "name": "SOS GmbH JobScheduler 2.5.10",
                  "product_id": "T037041-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sos_gmbh:jobscheduler:2.5.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2.6.7",
                "product": {
                  "name": "SOS GmbH JobScheduler \u003c2.6.7",
                  "product_id": "T037042"
                }
              },
              {
                "category": "product_version",
                "name": "2.6.7",
                "product": {
                  "name": "SOS GmbH JobScheduler 2.6.7",
                  "product_id": "T037042-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sos_gmbh:jobscheduler:2.6.7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JobScheduler"
          }
        ],
        "category": "vendor",
        "name": "SOS GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-42459",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen im JobScheduler der SOS GmbH. Diese Fehler in JS7 JOC Cockpit entstehen durch die Verwendung einer veralteten Version der Elliptic Library (6.5.5), die bekannte Schwachstellen enth\u00e4lt, die kryptographische Signaturen betreffen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um kryptografische Signaturen zu besch\u00e4digen, was zu unautorisiertem Zugriff und Datenmanipulation f\u00fchren kann."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037040",
          "T037041",
          "T037042"
        ]
      },
      "release_date": "2024-08-22T22:00:00.000+00:00",
      "title": "CVE-2024-42459"
    },
    {
      "cve": "CVE-2024-42460",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen im JobScheduler der SOS GmbH. Diese Fehler in JS7 JOC Cockpit entstehen durch die Verwendung einer veralteten Version der Elliptic Library (6.5.5), die bekannte Schwachstellen enth\u00e4lt, die kryptographische Signaturen betreffen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um kryptografische Signaturen zu besch\u00e4digen, was zu unautorisiertem Zugriff und Datenmanipulation f\u00fchren kann."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037040",
          "T037041",
          "T037042"
        ]
      },
      "release_date": "2024-08-22T22:00:00.000+00:00",
      "title": "CVE-2024-42460"
    },
    {
      "cve": "CVE-2024-42461",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen im JobScheduler der SOS GmbH. Diese Fehler in JS7 JOC Cockpit entstehen durch die Verwendung einer veralteten Version der Elliptic Library (6.5.5), die bekannte Schwachstellen enth\u00e4lt, die kryptographische Signaturen betreffen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um kryptografische Signaturen zu besch\u00e4digen, was zu unautorisiertem Zugriff und Datenmanipulation f\u00fchren kann."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037040",
          "T037041",
          "T037042"
        ]
      },
      "release_date": "2024-08-22T22:00:00.000+00:00",
      "title": "CVE-2024-42461"
    },
    {
      "cve": "CVE-2024-29857",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen im JobScheduler der SOS GmbH. Diese Fehler werden durch den unsachgem\u00e4\u00dfen Umgang mit manipulierten F2m-Parametern und der Ed25519-Signaturpr\u00fcfung in den Bouncy Castle-Bibliotheken verursacht, was zu einer Endlosschleife oder zu einer \u00fcberm\u00e4\u00dfigen CPU-Auslastung f\u00fchren kann. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037041",
          "T037042"
        ]
      },
      "release_date": "2024-08-22T22:00:00.000+00:00",
      "title": "CVE-2024-29857"
    },
    {
      "cve": "CVE-2024-30172",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen im JobScheduler der SOS GmbH. Diese Fehler werden durch den unsachgem\u00e4\u00dfen Umgang mit manipulierten F2m-Parametern und der Ed25519-Signaturpr\u00fcfung in den Bouncy Castle-Bibliotheken verursacht, was zu einer Endlosschleife oder zu einer \u00fcberm\u00e4\u00dfigen CPU-Auslastung f\u00fchren kann. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037041",
          "T037042"
        ]
      },
      "release_date": "2024-08-22T22:00:00.000+00:00",
      "title": "CVE-2024-30172"
    },
    {
      "cve": "CVE-2024-30171",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle im JobScheduler der SOS GmbH. Diese Fehler betrifft die Java TLS API und den JSSE Provider der Drittanbieterkomponente Bouncy Castle aufgrund eines zeitbasierten Seitenkanallecks w\u00e4hrend RSA-basierter Handshakes. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen preiszugeben."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037041",
          "T037042"
        ]
      },
      "release_date": "2024-08-22T22:00:00.000+00:00",
      "title": "CVE-2024-30171"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Confluence ist eine kommerzielle Wiki-Software.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Confluence ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, vertrauliche Informationen preiszugeben und Sicherheitsma\u00dfnahmen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3508 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3508.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3508 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3508"
      },
      {
        "category": "external",
        "summary": "Atlassian November 2024 Security Bulletin vom 2024-11-19",
        "url": "https://confluence.atlassian.com/security/security-bulletin-november-19-2024-1456179091.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Atlassian Confluence: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-11-19T23:00:00.000+00:00",
      "generator": {
        "date": "2024-11-20T10:42:48.003+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-3508",
      "initial_release_date": "2024-11-19T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-11-19T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.1.1",
                "product": {
                  "name": "Atlassian Confluence \u003c9.1.1",
                  "product_id": "T039313"
                }
              },
              {
                "category": "product_version",
                "name": "9.1.1",
                "product": {
                  "name": "Atlassian Confluence 9.1.1",
                  "product_id": "T039313-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:9.1.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.9.8",
                "product": {
                  "name": "Atlassian Confluence \u003c8.9.8",
                  "product_id": "T039314"
                }
              },
              {
                "category": "product_version",
                "name": "8.9.8",
                "product": {
                  "name": "Atlassian Confluence 8.9.8",
                  "product_id": "T039314-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:8.9.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "LTS \u003c8.5.17",
                "product": {
                  "name": "Atlassian Confluence LTS \u003c8.5.17",
                  "product_id": "T039315"
                }
              },
              {
                "category": "product_version",
                "name": "LTS 8.5.17",
                "product": {
                  "name": "Atlassian Confluence LTS 8.5.17",
                  "product_id": "T039315-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:lts__8.5.17"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "LTS \u003c7.19.29",
                "product": {
                  "name": "Atlassian Confluence LTS \u003c7.19.29",
                  "product_id": "T039316"
                }
              },
              {
                "category": "product_version",
                "name": "LTS 7.19.29",
                "product": {
                  "name": "Atlassian Confluence LTS 7.19.29",
                  "product_id": "T039316-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:lts__7.19.29"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Confluence"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-38900",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Atlassian Confluence. Diese Fehler betreffen mehrere Komponenten, darunter com.nimbusds, org.bouncycastle und tomcat-coyote. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039315",
          "T039314",
          "T039316",
          "T039313"
        ]
      },
      "release_date": "2024-11-19T23:00:00.000+00:00",
      "title": "CVE-2022-38900"
    },
    {
      "cve": "CVE-2023-52428",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Atlassian Confluence. Diese Fehler betreffen mehrere Komponenten, darunter com.nimbusds, org.bouncycastle und tomcat-coyote. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039315",
          "T039314",
          "T039316",
          "T039313"
        ]
      },
      "release_date": "2024-11-19T23:00:00.000+00:00",
      "title": "CVE-2023-52428"
    },
    {
      "cve": "CVE-2024-24549",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Atlassian Confluence. Diese Fehler betreffen mehrere Komponenten, darunter com.nimbusds, org.bouncycastle und tomcat-coyote. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039315",
          "T039314",
          "T039316",
          "T039313"
        ]
      },
      "release_date": "2024-11-19T23:00:00.000+00:00",
      "title": "CVE-2024-24549"
    },
    {
      "cve": "CVE-2024-30172",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Atlassian Confluence. Diese Fehler betreffen mehrere Komponenten, darunter com.nimbusds, org.bouncycastle und tomcat-coyote. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039315",
          "T039314",
          "T039316",
          "T039313"
        ]
      },
      "release_date": "2024-11-19T23:00:00.000+00:00",
      "title": "CVE-2024-30172"
    },
    {
      "cve": "CVE-2024-4068",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Atlassian Confluence. Diese Fehler betreffen mehrere Komponenten, darunter com.nimbusds, org.bouncycastle und tomcat-coyote. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039315",
          "T039314",
          "T039316",
          "T039313"
        ]
      },
      "release_date": "2024-11-19T23:00:00.000+00:00",
      "title": "CVE-2024-4068"
    },
    {
      "cve": "CVE-2023-46234",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Atlassian Confluence. Dieser Fehler besteht aufgrund einer unsachgem\u00e4\u00dfen Handhabung der kryptographischen Signatur\u00fcberpr\u00fcfung. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um die Authentifizierung und Sitzungsverwaltung zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039315",
          "T039314",
          "T039316",
          "T039313"
        ]
      },
      "release_date": "2024-11-19T23:00:00.000+00:00",
      "title": "CVE-2023-46234"
    },
    {
      "cve": "CVE-2024-38816",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Atlassian Confluence. Dieser Fehler betrifft spring-webmvc aufgrund eines Path Traversal Problems bei der Verwendung bestimmter Konfigurationen (RouterFunctions mit FileSystemResource). Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039315",
          "T039314",
          "T039316",
          "T039313"
        ]
      },
      "release_date": "2024-11-19T23:00:00.000+00:00",
      "title": "CVE-2024-38816"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter Angreifer kann mehrere Schwachstellen in Atlassian Bamboo ausnutzen, um Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu erzeugen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3663 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3663.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3663 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3663"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Bulletin December 2024 vom 2024-12-10",
        "url": "https://confluence.atlassian.com/security/security-bulletin-december-10-2024-1476624803.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Atlassian Bamboo: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-12-10T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-11T11:41:59.418+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-3663",
      "initial_release_date": "2024-12-10T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-12-10T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center \u003c9.6.8",
                "product": {
                  "name": "Atlassian Bamboo Data Center \u003c9.6.8",
                  "product_id": "T039700"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 9.6.8",
                "product": {
                  "name": "Atlassian Bamboo Data Center 9.6.8",
                  "product_id": "T039700-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center__9.6.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c9.2.21",
                "product": {
                  "name": "Atlassian Bamboo Data Center \u003c9.2.21",
                  "product_id": "T039701"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 9.2.21",
                "product": {
                  "name": "Atlassian Bamboo Data Center 9.2.21",
                  "product_id": "T039701-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center__9.2.21"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Server \u003c9.2.21",
                "product": {
                  "name": "Atlassian Bamboo Server \u003c9.2.21",
                  "product_id": "T039702"
                }
              },
              {
                "category": "product_version",
                "name": "Server 9.2.21",
                "product": {
                  "name": "Atlassian Bamboo Server 9.2.21",
                  "product_id": "T039702-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:server__9.2.21"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bamboo"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-31159",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Atlassian Bamboo. Dieser Fehler existiert wegen einer Amazon AWS Java-SDK-Abh\u00e4ngigkeit, die es erlaubt, Verzeichnisse auf dem System zu durchlaufen. Durch das Senden einer speziell gestalteten URL-Anfrage, die \"Punkt-Punkt\"-Sequenzen (/../) enth\u00e4lt, kann ein entfernter, authentifizierter Angreifer diese Schwachstelle ausnutzen, um beliebige Dateien auf dem System zu ver\u00e4ndern. Zur erfolgreichen Ausnutzung ist eine Benutzerinteraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039700",
          "T039702",
          "T039701"
        ]
      },
      "release_date": "2024-12-10T23:00:00.000+00:00",
      "title": "CVE-2022-31159"
    },
    {
      "cve": "CVE-2023-52428",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Atlassian Bamboo. Diese Fehler existieren wegen verschiedener Abh\u00e4ngigkeiten von Drittanbietern. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039700",
          "T039702",
          "T039701"
        ]
      },
      "release_date": "2024-12-10T23:00:00.000+00:00",
      "title": "CVE-2023-52428"
    },
    {
      "cve": "CVE-2024-24549",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Atlassian Bamboo. Diese Fehler existieren wegen verschiedener Abh\u00e4ngigkeiten von Drittanbietern. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039700",
          "T039702",
          "T039701"
        ]
      },
      "release_date": "2024-12-10T23:00:00.000+00:00",
      "title": "CVE-2024-24549"
    },
    {
      "cve": "CVE-2024-30172",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Atlassian Bamboo. Diese Fehler existieren wegen verschiedener Abh\u00e4ngigkeiten von Drittanbietern. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039700",
          "T039702",
          "T039701"
        ]
      },
      "release_date": "2024-12-10T23:00:00.000+00:00",
      "title": "CVE-2024-30172"
    },
    {
      "cve": "CVE-2024-25710",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Atlassian Bamboo. Dieser Fehler existiert wegen einer Apache Commons Compress-Abh\u00e4ngigkeit, die zu einer Endlosschleife f\u00fchrt. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039700",
          "T039702",
          "T039701"
        ]
      },
      "release_date": "2024-12-10T23:00:00.000+00:00",
      "title": "CVE-2024-25710"
    }
  ]
}