{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Streams for Apache Kafka 2.9.1 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed\nbackbone that allows microservices and other applications to share data with\nextremely high throughput and extremely low latency.\n\nThis release of Red Hat Streams for Apache Kafka 2.9.1serves as a replacement for Red Hat Streams for Apache Kafka 2.9.0, and includes security and bug fixes, and enhancements.\n\nSecurity Fix(es):\n* Cruise Control: json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) Security [amq-st-2] \"(CVE-2023-1370)\"\n* Cruise Control, Bridge, Kafka: o.netty:netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine Security[amq-st-2] \"(CVE-2025-24970)\"\n* Cruise Control, Bridge, Kafka: netty: Denial of Service attack on windows app using Netty Security [amq-st-2] \"(CVE-2025-25193)\"\n* Cruise Control: kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption Security [amq-st-2] \"(CVE-2024-56128)\"\n* Cruise Control, Operator: Jetty: Gzip Request Body Buffer Corruption Security[amq-st-2]\"(CVE-2024-13009)\"\n* Cruise Control: kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider Security [amq-st-2] \"(CVE-2024-31141)\"\n* Cruise Control, Oerator, Kafka: org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of invalid authority Security [amq-st-2] \"(CVE-2024-6763)\"\n* Zookeeper: netty: Denial of Service attack on windows app using Netty \n  Security [amq-st-2] \"(CVE-2024-47535)\"\n* Zookeeper, Kafka:  commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum\u0027s declaredClass property by default Security [amq-st-2] \"(CVE-2025-48734)\"\n* Bridge: org.apache.kafka: Kafka Client Arbitrary File Read SSRF Security [amq-st-2]\"(CVE-2025-27817)\"\n* Bridge, Drain Cleaner: io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout Security \"(CVE-2025-1634)\"",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:9922",
        "url": "https://access.redhat.com/errata/RHSA-2025:9922"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2188542",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188542"
      },
      {
        "category": "external",
        "summary": "2318563",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318563"
      },
      {
        "category": "external",
        "summary": "2325538",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325538"
      },
      {
        "category": "external",
        "summary": "2327264",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327264"
      },
      {
        "category": "external",
        "summary": "2333013",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333013"
      },
      {
        "category": "external",
        "summary": "2344787",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344787"
      },
      {
        "category": "external",
        "summary": "2344788",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344788"
      },
      {
        "category": "external",
        "summary": "2347319",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347319"
      },
      {
        "category": "external",
        "summary": "2365135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365135"
      },
      {
        "category": "external",
        "summary": "2368956",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368956"
      },
      {
        "category": "external",
        "summary": "2371367",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2371367"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9922.json"
      }
    ],
    "title": "Red Hat Security Advisory: Streams for Apache Kafka 2.9.1 release and security update",
    "tracking": {
      "current_release_date": "2026-06-01T17:23:07+00:00",
      "generator": {
        "date": "2026-06-01T17:23:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2025:9922",
      "initial_release_date": "2025-06-30T13:16:39+00:00",
      "revision_history": [
        {
          "date": "2025-06-30T13:16:39+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-06-30T13:16:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-01T17:23:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Streams for Apache Kafka 2.9.1",
                "product": {
                  "name": "Streams for Apache Kafka 2.9.1",
                  "product_id": "Streams for Apache Kafka 2.9.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_streams:2.9::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Streams for Apache Kafka"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-1370",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2023-04-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2188542"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the json-smart package. This security flaw occurs when reaching a \u2018[\u2018 or \u2018{\u2018 character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed recursively, nesting too many of them can cause stack exhaustion (stack overflow) and crash the software.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-1370"
        },
        {
          "category": "external",
          "summary": "RHBZ#2188542",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188542"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-1370",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-1370"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-1370",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1370"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-493p-pfq6-5258",
          "url": "https://github.com/advisories/GHSA-493p-pfq6-5258"
        },
        {
          "category": "external",
          "summary": "https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/",
          "url": "https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/"
        }
      ],
      "release_date": "2023-03-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)"
    },
    {
      "cve": "CVE-2024-6763",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2024-10-14T16:00:54.963689+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2318563"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Jetty. The HttpURI class performs insufficient validation on the authority segment of a URI. The HttpURI and the browser may differ on the value of the host extracted from an invalid URI. This combination of Jetty and a vulnerable browser may be vulnerable to an open redirect attack or an SSRF attack if the URI is used after passing validation checks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of invalid authority",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "For this attack to work, you would require the victim to have a vulnerable browser on top of that the URI being used after insufficient validation, all of which makes this a low-severity flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-6763"
        },
        {
          "category": "external",
          "summary": "RHBZ#2318563",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318563"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-6763",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-6763"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/pull/12012",
          "url": "https://github.com/jetty/jetty.project/pull/12012"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/25",
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/25"
        }
      ],
      "release_date": "2024-10-14T15:06:07.298000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of invalid authority"
    },
    {
      "cve": "CVE-2024-13009",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "discovery_date": "2025-05-08T18:00:47.047186+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2365135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Eclipse Jetty. This vulnerability allows corrupted and inadvertent data sharing between requests via a gzip error when inflating a request body. If the request body is malformed, the gzip decompression process can fail, resulting in the application inadvertently using data from a previous request when processing the current one.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jetty-server: Jetty: Gzip Request Body Buffer Corruption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an IMPORTANT severity because a buffer management vulnerability exists within the GzipHandler\u0027s buffer release mechanism when encountering gzip errors during request body inflation, this flaw can lead to the incorrect release and subsequent inadvertent sharing and corruption of request body data between concurrent uncompressed requests, results in data exposure and incorrect processing of requests due to corrupted input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-13009"
        },
        {
          "category": "external",
          "summary": "RHBZ#2365135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-13009",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-13009"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-13009",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13009"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/48",
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/48"
        }
      ],
      "release_date": "2025-05-08T17:29:31.380000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jetty-server: Jetty: Gzip Request Body Buffer Corruption"
    },
    {
      "cve": "CVE-2024-31141",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2024-11-19T09:00:35.857468+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2327264"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations, which include the ability to read from disk or environment variables. In applications where an untrusted party can specify Apache Kafka Clients configurations, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-31141"
        },
        {
          "category": "external",
          "summary": "RHBZ#2327264",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327264"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-31141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-31141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-31141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31141"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv",
          "url": "https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv"
        }
      ],
      "release_date": "2024-11-19T08:40:50.695000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider"
    },
    {
      "cve": "CVE-2024-47535",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-11-12T16:01:18.772613+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2325538"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. An unsafe reading of the environment file could potentially cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crashes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: Denial of Service attack on windows app using Netty",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47535"
        },
        {
          "category": "external",
          "summary": "RHBZ#2325538",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325538"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47535",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47535"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47535",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47535"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3",
          "url": "https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv"
        }
      ],
      "release_date": "2024-11-12T15:50:08.334000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty: Denial of Service attack on windows app using Netty"
    },
    {
      "cve": "CVE-2024-56128",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2024-12-18T14:00:43.732728+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2333013"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Kafka\u0027s implementation of the Salted Challenge Response Authentication Mechanism (SCRAM), which did not fully adhere to the requirements of RFC 5802. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message. However, Kafka\u0027s SCRAM implementation did not perform this validation. In environments where SCRAM is operated over plaintext communication channels, an attacker with access to the exchange can intercept and potentially reuse authentication messages, leveraging the weak nonce validation to gain unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is marked with an Important severity because it compromises a fundamental security requirement of the SCRAM protocol as specified in RFC 5802 \u2014the validation of nonces for ensuring message integrity and preventing replay attacks. Without proper nonce validation, an attacker with plaintext access to the SCRAM authentication exchange could manipulate or replay parts of the authentication process, potentially gaining unauthorized access or disrupting the integrity of authentication. While the use of plaintext communication for SCRAM is discouraged, many legacy systems or misconfigured deployments may still rely on it, making them directly susceptible.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-56128"
        },
        {
          "category": "external",
          "summary": "RHBZ#2333013",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333013"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-56128",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-56128"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56128",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56128"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc5802",
          "url": "https://datatracker.ietf.org/doc/html/rfc5802"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc5802#section-9",
          "url": "https://datatracker.ietf.org/doc/html/rfc5802#section-9"
        },
        {
          "category": "external",
          "summary": "https://kafka.apache.org/documentation/#security_sasl_scram_security",
          "url": "https://kafka.apache.org/documentation/#security_sasl_scram_security"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/84dh4so32lwn7wr6c5s9mwh381vx9wkw",
          "url": "https://lists.apache.org/thread/84dh4so32lwn7wr6c5s9mwh381vx9wkw"
        }
      ],
      "release_date": "2024-12-18T13:38:03.068000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption"
    },
    {
      "cve": "CVE-2025-1634",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2025-02-24T14:17:31.237000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2347319"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is marked as and Important severity rather than Moderate because it allows an unauthenticated attacker to trigger a denial of service  condition by repeatedly sending crafted HTTP requests with low timeouts. The issue leads to a memory leak that cannot be recovered without restarting the application, ultimately resulting in an OutOfMemoryError  and complete service failure.\n\nIn a production environment, this vulnerability poses a significant risk to availability, especially for applications handling multiple concurrent requests. Since no mitigation exists, all applications using quarkus-resteasy are affected until patched. The ease of exploitation, lack of required privileges, and high impact on service uptime justify the high severity rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-1634"
        },
        {
          "category": "external",
          "summary": "RHBZ#2347319",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347319"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-1634",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-1634"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-1634",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1634"
        },
        {
          "category": "external",
          "summary": "https://github.com/quarkusio/quarkus/issues/46412",
          "url": "https://github.com/quarkusio/quarkus/issues/46412"
        },
        {
          "category": "external",
          "summary": "https://github.com/quarkusio/quarkus/pull/46419",
          "url": "https://github.com/quarkusio/quarkus/pull/46419"
        }
      ],
      "release_date": "2025-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout"
    },
    {
      "cve": "CVE-2025-24970",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2025-02-10T23:00:52.785132+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2344787"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s SslHandler. This vulnerability allows a native crash via a specially crafted packet that bypasses proper validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty:netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Netty\u0027s SslHandler is of important severity rather than moderate because it directly impacts the stability and reliability of applications using native SSLEngine. By sending a specially crafted packet, an attacker can trigger a native crash, leading to a complete process termination. Unlike typical moderate vulnerabilities that might cause limited disruptions or require specific conditions, this flaw can be exploited remotely to induce a Denial of Service (DoS), affecting high-availability systems and mission-critical services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "RHBZ#2344787",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344787"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-24970",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-24970",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4",
          "url": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw"
        }
      ],
      "release_date": "2025-02-10T21:57:28.730000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty:netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine"
    },
    {
      "cve": "CVE-2025-25193",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2025-02-10T23:00:54.794769+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2344788"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. An unsafe reading of the environment file could cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: Denial of Service attack on windows app using Netty",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue only affects Windows environments, therefore, this would affect an environment when running a supported Red Hat JBoss EAP 7 or 8, for example, if running on Windows.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-25193"
        },
        {
          "category": "external",
          "summary": "RHBZ#2344788",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344788"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-25193",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-25193"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-25193",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25193"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386",
          "url": "https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhx",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhx"
        }
      ],
      "release_date": "2025-02-10T22:02:17.197000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty: Denial of Service attack on windows app using Netty"
    },
    {
      "cve": "CVE-2025-27817",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2025-06-10T08:00:46.717358+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2371367"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in apache-kafka. The Kafka client improperly handles configuration data for SASL/OAUTHBEARER connections, allowing an attacker to specify a crafted token endpoint URL. This allows for arbitrary file reads and server-side request forgery (SSRF) by a malicious client. Consequently, this can allow an attacker to read arbitrary files on the Kafka broker or initiate requests to internal or external resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.kafka: Kafka Client Arbitrary File Read SSRF",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-27817"
        },
        {
          "category": "external",
          "summary": "RHBZ#2371367",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2371367"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-27817",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-27817"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-27817",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27817"
        },
        {
          "category": "external",
          "summary": "https://kafka.apache.org/cve-list",
          "url": "https://kafka.apache.org/cve-list"
        }
      ],
      "release_date": "2025-06-10T07:55:14.422000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw, explicitly set the allowed urls in SASL JAAS configuration using the system property \"-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls\".",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.apache.kafka: Kafka Client Arbitrary File Read SSRF"
    },
    {
      "cve": "CVE-2025-48734",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2025-05-28T14:00:56.619771+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2368956"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like getProperty() or getNestedProperty().",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum\u0027s declaredClass property by default",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as important severity because a flaw exists in Apache Commons BeanUtils, where PropertyUtilsBean and BeanUtilsBean allow uncontrolled access to the declaredClass property of Java enum objects. Applications that pass untrusted property paths directly to getProperty() or getNestedProperty() methods are at risk, as attackers can exploit this behavior to retrieve the ClassLoader instance and execute arbitrary code in the context of the affected application. This issue leads to compromise of confidentiality, integrity, and availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Streams for Apache Kafka 2.9.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-48734"
        },
        {
          "category": "external",
          "summary": "RHBZ#2368956",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368956"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48734"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-wxr5-93ph-8wr9",
          "url": "https://github.com/advisories/GHSA-wxr5-93ph-8wr9"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/commons-beanutils/commit/28ad955a1613ed5885870cc7da52093c1ce739dc",
          "url": "https://github.com/apache/commons-beanutils/commit/28ad955a1613ed5885870cc7da52093c1ce739dc"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9",
          "url": "https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2025/05/28/6",
          "url": "https://www.openwall.com/lists/oss-security/2025/05/28/6"
        }
      ],
      "release_date": "2025-05-28T13:32:08.300000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-30T13:16:39+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Streams for Apache Kafka 2.9.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9922"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Streams for Apache Kafka 2.9.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum\u0027s declaredClass property by default"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for apache-commons-beanutils",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for apache-commons-beanutils fixes the following issues:\n\nUpdate to 1.11.0\n\n- CVE-2025-48734: Fixed possible arbitrary code execution vulnerability (bsc#1243793)\n\nFull changelog:\n\nhttps://commons.apache.org/proper/commons-beanutils/changes.html#a1.11.0\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-1815,SUSE-SLE-Module-Web-Scripting-15-SP6-2025-1815,SUSE-SLE-Module-Web-Scripting-15-SP7-2025-1815,SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-1815,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-1815,SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-1815,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-1815,SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-1815,SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-1815,SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-1815,SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-1815,SUSE-SLE-Product-SLES_SAP-15-SP3-2025-1815,SUSE-SLE-Product-SLES_SAP-15-SP4-2025-1815,SUSE-SLE-Product-SLES_SAP-15-SP5-2025-1815,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-1815,SUSE-Storage-7.1-2025-1815,openSUSE-SLE-15.6-2025-1815",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_01815-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:01815-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202501815-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:01815-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-June/040143.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243793",
        "url": "https://bugzilla.suse.com/1243793"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48734 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48734/"
      }
    ],
    "title": "Security update for apache-commons-beanutils",
    "tracking": {
      "current_release_date": "2025-06-04T17:01:27Z",
      "generator": {
        "date": "2025-06-04T17:01:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:01815-1",
      "initial_release_date": "2025-06-04T17:01:27Z",
      "revision_history": [
        {
          "date": "2025-06-04T17:01:27Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
                "product": {
                  "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
                  "product_id": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "apache-commons-beanutils-javadoc-1.11.0-150200.3.9.1.noarch",
                "product": {
                  "name": "apache-commons-beanutils-javadoc-1.11.0-150200.3.9.1.noarch",
                  "product_id": "apache-commons-beanutils-javadoc-1.11.0-150200.3.9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
                  "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-web-scripting:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-web-scripting:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Server 4.3",
                "product": {
                  "name": "SUSE Manager Server 4.3",
                  "product_id": "SUSE Manager Server 4.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-server:4.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 7.1",
                "product": {
                  "name": "SUSE Enterprise Storage 7.1",
                  "product_id": "SUSE Enterprise Storage 7.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:7.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Manager Server 4.3",
          "product_id": "SUSE Manager Server 4.3:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Manager Server 4.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-javadoc-1.11.0-150200.3.9.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:apache-commons-beanutils-javadoc-1.11.0-150200.3.9.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-javadoc-1.11.0-150200.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-48734",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48734"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum\u0027s class loader via the \"declaredClass\" property available on all Java \"enum\" objects. Accessing the enum\u0027s \"declaredClass\" allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the \"declaredClass\" property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user\u0027s guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7.1:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "SUSE Manager Server 4.3:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.6:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
          "openSUSE Leap 15.6:apache-commons-beanutils-javadoc-1.11.0-150200.3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48734",
          "url": "https://www.suse.com/security/cve/CVE-2025-48734"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243793 for CVE-2025-48734",
          "url": "https://bugzilla.suse.com/1243793"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7.1:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Manager Server 4.3:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.6:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.6:apache-commons-beanutils-javadoc-1.11.0-150200.3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7.1:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "SUSE Manager Server 4.3:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.6:apache-commons-beanutils-1.11.0-150200.3.9.1.noarch",
            "openSUSE Leap 15.6:apache-commons-beanutils-javadoc-1.11.0-150200.3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-04T17:01:27Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-48734"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for apache-commons-beanutils",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for apache-commons-beanutils fixes the following issues:\n\nUpdate to 1.11.0:\n\n  * Fixed Bugs:\n\n    + BeanComparator.compare(T, T) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      all cases of ReflectiveOperationException.\n    + MappedMethodReference.get() now throws IllegalStateException\n      instead of RuntimeException to wrap cases of\n      NoSuchMethodException.\n    + ResultSetIterator.get(String) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      cases of SQLException.\n    + ResultSetIterator.hasNext() now throws IllegalStateException\n      instead of RuntimeException to wrap cases of SQLException.\n    + ResultSetIterator.next() now throws IllegalStateException\n      instead of RuntimeException to wrap cases of SQLException.\n    + ResultSetIterator.set(String, Object) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      cases of SQLException.\n    + ResultSetIterator.set(String, String, Object) now throws\n      IllegalArgumentException instead of RuntimeException to wrap\n      cases of SQLException.\n\n  * Changes:\n\n    + Add org.apache.commons.beanutils\n      .SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS.\n      Fixes bsc#1243793, CVE-2025-48734\n    + Bump org.apache.commons:commons-parent from 81 to 84.\n    + Bump commons-logging:commons-logging from 1.3.4 to 1.3.5.\n\nUpdate to 1.10.1:\n\n  * Fixed Bugs:\n\n    + BEANUTILS-541:  FluentPropertyBeanIntrospector concurrency\n      issue (backport to 1.X) #325.\n    + Javadoc is missing its Overview page.\n    + Remove -nouses directive from maven-bundle-plugin. OSGi\n      package imports now state \u0027uses\u0027 definitions for package\n      imports, this doesn\u0027t affect JPMS (from\n      org.apache.commons:commons-parent:80).\n    + Deprecate BeanUtils.BeanUtils().\n    + Deprecate ConstructorUtils.ConstructorUtils().\n    + Deprecate LocaleBeanUtils.LocaleBeanUtils().\n    + Deprecate LocaleConvertUtils.LocaleConvertUtils().\n    + Deprecate ConvertUtils.ConvertUtils().\n    + Deprecate MethodUtils.MethodUtils().\n    + Deprecate PropertyUtils.PropertyUtils().\n\n  * Changes:\n\n    + Bump org.apache.commons:commons-parent from 78 to 81.\n\nIncludes changes from 1.10.0:\n\n  * Fixed Bugs:\n\n    + BEANUTILS-541:  FluentPropertyBeanIntrospector caches\n      corrupted writeMethod (1.x backport) #69.\n    + Replace internal use of Locale.ENGLISH with Locale.ROOT.\n    + Replace Maven CLIRR plugin with JApiCmp.\n    + Port to Java 1.4 Throwable APIs (!).\n    + Fix Javadoc generation on Java 8, 17, and 21.\n    + AbstractArrayConverter.parseElements(String) now returns a\n      List\u003cString\u003e instead of a raw List.\n\n  * Changes:\n\n    + Bump org.apache.commons:commons-parent from 47 to 78.\n    + Bump Java requirement from Java 6 to 8.\n    + Bump junit:junit from 4.12 to 4.13.2.\n    + Bump JUnit from 4.x to 5.x \u0027vintage\u0027.\n    + Bump commons-logging:commons-logging from 1.2 to 1.3.4.\n    + Deprecate BeanUtilsBean.initCause(Throwable, Throwable) for\n      removal, use Throwable.initCause(Throwable).\n    + Deprecate BeanUtils.initCause(Throwable, Throwable) for\n      removal, use Throwable.initCause(Throwable).\n\nUpdate to 1.9.4:\n\n  * BEANUTILS-520: BeanUtils mitigate CVE-2014-0114\n\nUpdated to 1.9.3:\n\n  * This is a bug fix release, which also improves the tests for\n    building on Java 8.\n  * Note that Java 8 and later no longer support indexed bean\n    properties on java.util.List, only on arrays like String[].\t\n    (BEANUTILS-492). This affects PropertyUtils.getPropertyType()\n    and PropertyUtils.getPropertyDescriptor(); their javadoc have\n    therefore been updated to reflect this change in the JDK.\n\n  * Changes in this version include:\n\n    - Fixed Bugs:\n\n      * BEANUTILS-477: Changed log level in FluentPropertyBeanIntrospector\n      * BEANUTILS-492: Fixed exception when setting indexed properties\n          on DynaBeans.\n      * BEANUTILS-470: Precision lost when converting BigDecimal.\n      * BEANUTILS-465: Indexed List Setters fixed.\n\n    - Changes:\n\n      * BEANUTILS-433: Update dependency from JUnit 3.8.1 to 4.12.\n      * BEANUTILS-469: Update commons-logging from 1.1.1 to 1.2.\n      * BEANUTILS-474: FluentPropertyBeanIntrospector does not use the\n      \tsame naming algorithm as DefaultBeanIntrospector.\n      * BEANUTILS-490: Update Java requirement from Java 5 to 6.\n      * BEANUTILS-482: Update commons-collections from 3.2.1 to 3.2.2\n        (CVE-2015-4852).\n      * BEANUTILS-490: Update java requirement to Java 6.\n      * BEANUTILS-492: IndexedPropertyDescriptor tests now pass on Java 8.\n      * BEANUTILS-495: DateConverterTestBase fails on M/d/yy in Java 9.\n      * BEANUTILS-496: testGetDescriptorInvalidBoolean fails on Java 9.\n    - Historical list of changes:\n      http://commons.apache.org/proper/commons-beanutils/changes-report.html\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-2056,SUSE-SLE-SERVER-12-SP5-LTSS-2025-2056,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-2056",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_02056-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:02056-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202502056-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:02056-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-June/040424.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243793",
        "url": "https://bugzilla.suse.com/1243793"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-0114 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-0114/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-4852 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-4852/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48734 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48734/"
      }
    ],
    "title": "Security update for apache-commons-beanutils",
    "tracking": {
      "current_release_date": "2025-06-20T16:17:22Z",
      "generator": {
        "date": "2025-06-20T16:17:22Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:02056-1",
      "initial_release_date": "2025-06-20T16:17:22Z",
      "revision_history": [
        {
          "date": "2025-06-20T16:17:22Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-commons-beanutils-1.11.0-7.3.1.noarch",
                "product": {
                  "name": "apache-commons-beanutils-1.11.0-7.3.1.noarch",
                  "product_id": "apache-commons-beanutils-1.11.0-7.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
                "product": {
                  "name": "apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
                  "product_id": "apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-7.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-1.11.0-7.3.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-7.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-1.11.0-7.3.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-1.11.0-7.3.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-1.11.0-7.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
        },
        "product_reference": "apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-0114",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-0114"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-1.11.0-7.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-1.11.0-7.3.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-0114",
          "url": "https://www.suse.com/security/cve/CVE-2014-0114"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 778464 for CVE-2014-0114",
          "url": "https://bugzilla.suse.com/778464"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 875455 for CVE-2014-0114",
          "url": "https://bugzilla.suse.com/875455"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 885963 for CVE-2014-0114",
          "url": "https://bugzilla.suse.com/885963"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-20T16:17:22Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-0114"
    },
    {
      "cve": "CVE-2015-4852",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-4852"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-1.11.0-7.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-1.11.0-7.3.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-4852",
          "url": "https://www.suse.com/security/cve/CVE-2015-4852"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 954102 for CVE-2015-4852",
          "url": "https://bugzilla.suse.com/954102"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 955853 for CVE-2015-4852",
          "url": "https://bugzilla.suse.com/955853"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-20T16:17:22Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2015-4852"
    },
    {
      "cve": "CVE-2025-48734",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48734"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum\u0027s class loader via the \"declaredClass\" property available on all Java \"enum\" objects. Accessing the enum\u0027s \"declaredClass\" allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the \"declaredClass\" property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user\u0027s guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-1.11.0-7.3.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-1.11.0-7.3.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48734",
          "url": "https://www.suse.com/security/cve/CVE-2025-48734"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243793 for CVE-2025-48734",
          "url": "https://bugzilla.suse.com/1243793"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-1.11.0-7.3.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:apache-commons-beanutils-javadoc-1.11.0-7.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-06-20T16:17:22Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-48734"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache Commons ist ein Apache-Projekt, das alle Aspekte der wiederverwendbaren Java-Komponenten behandelt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Commons BeanUtils ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-1169 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1169.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-1169 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1169"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-9114 vom 2025-06-19",
        "url": "https://linux.oracle.com/errata/ELSA-2025-9114.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:9318 vom 2025-06-23",
        "url": "https://access.redhat.com/errata/RHSA-2025:9318"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2025-2899 vom 2025-06-24",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2025-2899.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:02056-1 vom 2025-06-20",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-June/021617.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Bugtracker vom 2025-05-29",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368956"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2025-05-29",
        "url": "https://github.com/advisories/GHSA-wxr5-93ph-8wr9"
      },
      {
        "category": "external",
        "summary": "OSS Security Mailing List vom 2025-05-29",
        "url": "https://seclists.org/oss-sec/2025/q2/175"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:01815-1 vom 2025-06-04",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-June/021416.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:8265 vom 2025-06-05",
        "url": "https://access.redhat.com/errata/RHSA-2025:8265"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:8919 vom 2025-06-11",
        "url": "https://access.redhat.com/errata/RHSA-2025:8919"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2025-3EB7C0066F vom 2025-06-13",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-3eb7c0066f"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2025-48E8E5F8ED vom 2025-06-13",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-48e8e5f8ed"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:9115 vom 2025-06-16",
        "url": "https://access.redhat.com/errata/RHSA-2025:9115"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:9114 vom 2025-06-16",
        "url": "https://access.redhat.com/errata/RHSA-2025:9114"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:9117 vom 2025-06-16",
        "url": "https://access.redhat.com/errata/RHSA-2025:9117"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:9166 vom 2025-06-17",
        "url": "https://access.redhat.com/errata/RHSA-2025:9166"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:9697 vom 2025-06-26",
        "url": "https://access.redhat.com/errata/RHSA-2025:9697"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:9696 vom 2025-06-26",
        "url": "https://access.redhat.com/errata/RHSA-2025:9696"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-9166 vom 2025-06-28",
        "url": "http://linux.oracle.com/errata/ELSA-2025-9166.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4229 vom 2025-06-25",
        "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00027.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:9922 vom 2025-06-30",
        "url": "https://access.redhat.com/errata/RHSA-2025:9922"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2025-2899 vom 2025-06-30",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2025-2899.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7238747 vom 2025-07-02",
        "url": "https://www.ibm.com/support/pages/node/7238747"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:10459 vom 2025-07-08",
        "url": "https://access.redhat.com/errata/RHSA-2025:10459"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:10452 vom 2025-07-08",
        "url": "https://access.redhat.com/errata/RHSA-2025:10452"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:10453 vom 2025-07-07",
        "url": "https://access.redhat.com/errata/RHSA-2025:10453"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-9318 vom 2025-07-09",
        "url": "https://linux.oracle.com/errata/ELSA-2025-9318.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:10814 vom 2025-07-10",
        "url": "https://access.redhat.com/errata/RHSA-2025:10814"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:10925 vom 2025-07-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:10925"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:10931 vom 2025-07-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:10931"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:10926 vom 2025-07-14",
        "url": "https://access.redhat.com/errata/RHSA-2025:10926"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:10924 vom 2025-07-14",
        "url": "https://access.redhat.com/errata/RHSA-2025:10924"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7239757 vom 2025-07-15",
        "url": "https://www.ibm.com/support/pages/node/7239757"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Bulletin - July 15 2025",
        "url": "https://confluence.atlassian.com/security/security-bulletin-july-15-2025-1590658642.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-10814 vom 2025-07-30",
        "url": "https://linux.oracle.com/errata/ELSA-2025-10814.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:12511 vom 2025-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2025:12511"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7241547 vom 2025-08-06",
        "url": "https://www.ibm.com/support/pages/node/7241547"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:13274 vom 2025-08-06",
        "url": "https://access.redhat.com/errata/RHSA-2025:13274"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7242967 vom 2025-08-23",
        "url": "https://www.ibm.com/support/pages/node/7242967"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7243781 vom 2025-09-02",
        "url": "https://www.ibm.com/support/pages/node/7243781"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7244384 vom 2025-09-09",
        "url": "https://www.ibm.com/support/pages/node/7244384"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:15811 vom 2025-09-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:15811"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:15812 vom 2025-09-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:15812"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:15810 vom 2025-09-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:15810"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:15814 vom 2025-09-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:15814"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:15813 vom 2025-09-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:15813"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:15817 vom 2025-09-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:15817"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:15816 vom 2025-09-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:15816"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:15815 vom 2025-09-15",
        "url": "https://access.redhat.com/errata/RHSA-2025:15815"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Advisory",
        "url": "https://jira.atlassian.com/browse/CONFSERVER-100795"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:16409 vom 2025-09-23",
        "url": "https://access.redhat.com/errata/RHSA-2025:16409"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:16668 vom 2025-09-25",
        "url": "https://access.redhat.com/errata/RHSA-2025:16668"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:16667 vom 2025-09-25",
        "url": "https://access.redhat.com/errata/RHSA-2025:16667"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7246098 vom 2025-09-29",
        "url": "https://www.ibm.com/support/pages/node/7246098"
      },
      {
        "category": "external",
        "summary": "SAS Security Update vom 2025-10-02",
        "url": "https://support.sas.com/en/security-bulletins/sas-security-update-for-sas-94m9-ts1m9.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2025:9114 vom 2025-10-04",
        "url": "https://errata.build.resf.org/RLSA-2025:9114"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2025:9166 vom 2025-10-03",
        "url": "https://errata.build.resf.org/RLSA-2025:9166"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7247346 vom 2025-10-07",
        "url": "https://www.ibm.com/support/pages/node/7247346"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7249058 vom 2025-10-24",
        "url": "https://www.ibm.com/support/pages/node/7249058"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7249358 vom 2025-10-28",
        "url": "https://www.ibm.com/support/pages/node/7249358"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7249815 vom 2025-10-31",
        "url": "https://www.ibm.com/support/pages/node/7249815"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Bulletin - November 18 2025",
        "url": "https://confluence.atlassian.com/security/security-bulletin-november-18-2025-1671463469.html"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2025-415 vom 2025-12-22",
        "url": "https://www.dell.com/support/kbdoc/000405813"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7255296 vom 2026-01-21",
        "url": "https://www.ibm.com/support/pages/node/7255296"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202601-05 vom 2026-01-26",
        "url": "https://security.gentoo.org/glsa/202601-05"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2026-152 vom 2026-03-23",
        "url": "https://www.dell.com/support/kbdoc/de-de/000443243/dsa-2026-152-dell-secure-connect-gateway-security-update-for-multiple-third-party-component-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7267699 vom 2026-03-27",
        "url": "https://www.ibm.com/support/pages/node/7267699"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-8322-1 vom 2026-05-27",
        "url": "https://ubuntu.com/security/notices/USN-8322-1"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache Commons BeanUtils: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2026-05-27T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-28T07:26:12.448+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2025-1169",
      "initial_release_date": "2025-05-29T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-05-29T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-06-04T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von SUSE und Red Hat aufgenommen"
        },
        {
          "date": "2025-06-11T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-06-12T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2025-06-16T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-06-19T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-06-22T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2025-06-24T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2025-06-25T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-06-29T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Oracle Linux und Debian aufgenommen"
        },
        {
          "date": "2025-06-30T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat und Amazon aufgenommen"
        },
        {
          "date": "2025-07-02T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-07-07T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-07-08T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-07-10T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-07-14T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-07-15T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-07-30T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-08-03T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-08-06T22:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von IBM und Red Hat aufgenommen"
        },
        {
          "date": "2025-08-24T22:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-09-02T22:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-09-09T22:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-09-15T22:00:00.000+00:00",
          "number": "24",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-09-16T22:00:00.000+00:00",
          "number": "25",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2025-09-22T22:00:00.000+00:00",
          "number": "26",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-09-24T22:00:00.000+00:00",
          "number": "27",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-09-29T22:00:00.000+00:00",
          "number": "28",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-10-05T22:00:00.000+00:00",
          "number": "29",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2025-10-07T22:00:00.000+00:00",
          "number": "30",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-10-23T22:00:00.000+00:00",
          "number": "31",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-10-27T23:00:00.000+00:00",
          "number": "32",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-10-30T23:00:00.000+00:00",
          "number": "33",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-11-18T23:00:00.000+00:00",
          "number": "34",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2025-12-21T23:00:00.000+00:00",
          "number": "35",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2026-01-20T23:00:00.000+00:00",
          "number": "36",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-01-25T23:00:00.000+00:00",
          "number": "37",
          "summary": "Neue Updates von Gentoo aufgenommen"
        },
        {
          "date": "2026-03-23T23:00:00.000+00:00",
          "number": "38",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2026-03-26T23:00:00.000+00:00",
          "number": "39",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-05-27T22:00:00.000+00:00",
          "number": "40",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        }
      ],
      "status": "final",
      "version": "40"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "beanutils \u003c1.11.0",
                "product": {
                  "name": "Apache Commons beanutils \u003c1.11.0",
                  "product_id": "T044228"
                }
              },
              {
                "category": "product_version",
                "name": "beanutils 1.11.0",
                "product": {
                  "name": "Apache Commons beanutils 1.11.0",
                  "product_id": "T044228-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:commons:beanutils__1.11.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "beanutils2 \u003c2.0.0-M2",
                "product": {
                  "name": "Apache Commons beanutils2 \u003c2.0.0-M2",
                  "product_id": "T044229"
                }
              },
              {
                "category": "product_version",
                "name": "beanutils2 2.0.0-M2",
                "product": {
                  "name": "Apache Commons beanutils2 2.0.0-M2",
                  "product_id": "T044229-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:commons:beanutils2__2.0.0-m2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Commons"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c11.0.3",
                "product": {
                  "name": "Atlassian Bamboo \u003c11.0.3",
                  "product_id": "T045447"
                }
              },
              {
                "category": "product_version",
                "name": "11.0.3",
                "product": {
                  "name": "Atlassian Bamboo 11.0.3",
                  "product_id": "T045447-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:11.0.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.2.6 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo \u003c10.2.6 (LTS)",
                  "product_id": "T045448"
                }
              },
              {
                "category": "product_version",
                "name": "10.2.6 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo 10.2.6 (LTS)",
                  "product_id": "T045448-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:10.2.6_%28lts%29"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.6.15 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo \u003c9.6.15 (LTS)",
                  "product_id": "T045449"
                }
              },
              {
                "category": "product_version",
                "name": "9.6.15 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo 9.6.15 (LTS)",
                  "product_id": "T045449-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:9.6.15_%28lts%29"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bamboo"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.0.2",
                "product": {
                  "name": "Atlassian Bitbucket \u003c10.0.2",
                  "product_id": "T048675"
                }
              },
              {
                "category": "product_version",
                "name": "10.0.2",
                "product": {
                  "name": "Atlassian Bitbucket 10.0.2",
                  "product_id": "T048675-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:10.0.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.19.25 (LTS)",
                "product": {
                  "name": "Atlassian Bitbucket \u003c8.19.25 (LTS)",
                  "product_id": "T048676"
                }
              },
              {
                "category": "product_version",
                "name": "8.19.25 (LTS)",
                "product": {
                  "name": "Atlassian Bitbucket 8.19.25 (LTS)",
                  "product_id": "T048676-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:8.19.25_%28lts%29"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.4.13 (LTS)",
                "product": {
                  "name": "Atlassian Bitbucket \u003c9.4.13 (LTS)",
                  "product_id": "T048677"
                }
              },
              {
                "category": "product_version",
                "name": "9.4.13 (LTS)",
                "product": {
                  "name": "Atlassian Bitbucket 9.4.13 (LTS)",
                  "product_id": "T048677-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:9.4.13_%28lts%29"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bitbucket"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.2.6",
                "product": {
                  "name": "Atlassian Confluence \u003c9.2.6",
                  "product_id": "T047025"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.6",
                "product": {
                  "name": "Atlassian Confluence 9.2.6",
                  "product_id": "T047025-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:9.2.6"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.5.24",
                "product": {
                  "name": "Atlassian Confluence \u003c8.5.24",
                  "product_id": "T047026"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.24",
                "product": {
                  "name": "Atlassian Confluence 8.5.24",
                  "product_id": "T047026-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:8.5.24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.5.2",
                "product": {
                  "name": "Atlassian Confluence \u003c9.5.2",
                  "product_id": "T047027"
                }
              },
              {
                "category": "product_version",
                "name": "9.5.2",
                "product": {
                  "name": "Atlassian Confluence 9.5.2",
                  "product_id": "T047027-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:9.5.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.0.3",
                "product": {
                  "name": "Atlassian Confluence \u003c10.0.3",
                  "product_id": "T047028"
                }
              },
              {
                "category": "product_version",
                "name": "10.0.3",
                "product": {
                  "name": "Atlassian Confluence 10.0.3",
                  "product_id": "T047028-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:10.0.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Confluence"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Dell PowerProtect Data Domain",
            "product": {
              "name": "Dell PowerProtect Data Domain",
              "product_id": "T045852",
              "product_identification_helper": {
                "cpe": "cpe:/a:dell:powerprotect_data_domain:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.34.00.16",
                "product": {
                  "name": "Dell Secure Connect Gateway \u003c5.34.00.16",
                  "product_id": "T052048"
                }
              },
              {
                "category": "product_version",
                "name": "5.34.00.16",
                "product": {
                  "name": "Dell Secure Connect Gateway 5.34.00.16",
                  "product_id": "T052048-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:dell:secure_connect_gateway:5.34.00.16"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Secure Connect Gateway"
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM App Connect Enterprise",
            "product": {
              "name": "IBM App Connect Enterprise",
              "product_id": "T032495",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:app_connect_enterprise:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "IBM Business Automation Workflow",
                "product": {
                  "name": "IBM Business Automation Workflow",
                  "product_id": "T019704",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Business Automation Workflow",
                "product": {
                  "name": "IBM Business Automation Workflow",
                  "product_id": "T043411",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:business_automation_workflow:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Business Automation Workflow"
          },
          {
            "category": "product_name",
            "name": "IBM InfoSphere Information Server",
            "product": {
              "name": "IBM InfoSphere Information Server",
              "product_id": "T035705",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:infosphere_information_server:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "IBM Operational Decision Manager",
            "product": {
              "name": "IBM Operational Decision Manager",
              "product_id": "T005180",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:operational_decision_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "IBM QRadar SIEM",
            "product": {
              "name": "IBM QRadar SIEM",
              "product_id": "T021415",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:qradar_siem:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Analytic Server",
                "product": {
                  "name": "IBM SPSS Analytic Server",
                  "product_id": "T011787",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spss:analytic_server"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Collaboration and Deployment Services 8.5",
                "product": {
                  "name": "IBM SPSS Collaboration and Deployment Services 8.5",
                  "product_id": "T038750",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spss:collaboration_and_deployment_services_8.5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Collaboration and Deployment Services 8.6",
                "product": {
                  "name": "IBM SPSS Collaboration and Deployment Services 8.6",
                  "product_id": "T046466",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spss:collaboration_and_deployment_services_8.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SPSS"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.5",
                "product": {
                  "name": "IBM Security Guardium 11.5",
                  "product_id": "1411051",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:security_guardium:11.5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Security Guardium",
                "product": {
                  "name": "IBM Security Guardium",
                  "product_id": "T021345",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:security_guardium:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Security Guardium"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.2.0.6",
                "product": {
                  "name": "IBM Tivoli Business Service Manager \u003c6.2.0.6",
                  "product_id": "T045011"
                }
              },
              {
                "category": "product_version",
                "name": "6.2.0.6",
                "product": {
                  "name": "IBM Tivoli Business Service Manager 6.2.0.6",
                  "product_id": "T045011-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:tivoli_business_service_manager:6.2.0.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Tivoli Business Service Manager"
          },
          {
            "category": "product_name",
            "name": "IBM Tivoli Netcool/OMNIbus",
            "product": {
              "name": "IBM Tivoli Netcool/OMNIbus",
              "product_id": "T004181",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:tivoli_netcool%2fomnibus:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "IP Edition \u003c4.2 Fix Pack 23",
                "product": {
                  "name": "IBM Tivoli Network Manager IP Edition \u003c4.2 Fix Pack 23",
                  "product_id": "T046654"
                }
              },
              {
                "category": "product_version",
                "name": "IP Edition  4.2 Fix Pack 23",
                "product": {
                  "name": "IBM Tivoli Network Manager IP Edition  4.2 Fix Pack 23",
                  "product_id": "T046654-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition___4.2_fix_pack_23"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Tivoli Network Manager"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T032255",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Cryostat 4",
                "product": {
                  "name": "Red Hat Enterprise Linux Cryostat 4",
                  "product_id": "T042558",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:cryostat_4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Apache Camel 1",
                "product": {
                  "name": "Red Hat Enterprise Linux Apache Camel 1",
                  "product_id": "T044468",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:apache_camel_1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.12.5",
                "product": {
                  "name": "Red Hat JBoss A-MQ \u003c7.12.5",
                  "product_id": "T047116"
                }
              },
              {
                "category": "product_version",
                "name": "7.12.5",
                "product": {
                  "name": "Red Hat JBoss A-MQ 7.12.5",
                  "product_id": "T047116-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:7.12.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss A-MQ"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform",
                  "product_id": "T003085",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:-"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.0.8",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform \u003c8.0.8",
                  "product_id": "T045085"
                }
              },
              {
                "category": "product_version",
                "name": "8.0.8",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 8.0.8",
                  "product_id": "T045085-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.4.23",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform \u003c7.4.23",
                  "product_id": "T045348"
                }
              },
              {
                "category": "product_version",
                "name": "7.4.23",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.4.23",
                  "product_id": "T045348-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4.23"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.4M9 (TS1M9)",
                "product": {
                  "name": "SAS Institute Base SAS \u003c9.4M9 (TS1M9)",
                  "product_id": "T047382"
                }
              },
              {
                "category": "product_version",
                "name": "9.4M9 (TS1M9)",
                "product": {
                  "name": "SAS Institute Base SAS 9.4M9 (TS1M9)",
                  "product_id": "T047382-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sas:base_sas:9.4m9_%28ts1m9%29"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Base SAS"
          }
        ],
        "category": "vendor",
        "name": "SAS Institute"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-48734",
      "product_status": {
        "known_affected": [
          "T047382",
          "67646",
          "T011787",
          "T004914",
          "T045448",
          "T045348",
          "T045447",
          "T045449",
          "T021415",
          "T042558",
          "T005180",
          "T045085",
          "398363",
          "T047027",
          "T046654",
          "T047028",
          "T048677",
          "T003085",
          "T047025",
          "T048676",
          "T047026",
          "T048675",
          "T035705",
          "T012167",
          "T038750",
          "T032255",
          "T052048",
          "74185",
          "T032495",
          "T043411",
          "T045852",
          "T021345",
          "T044468",
          "2951",
          "T002207",
          "T044229",
          "T044228",
          "T000126",
          "T019704",
          "T004181",
          "T045011",
          "T046466",
          "T047116",
          "1411051"
        ]
      },
      "release_date": "2025-05-29T22:00:00.000+00:00",
      "title": "CVE-2025-48734"
    }
  ]
}