Vulnerability-Lookup

RHBA-2025:7639

Vulnerability from csaf_redhat - Published: 2025-05-14 23:43 - Updated: 2026-11-01 04:50

Summary

Red Hat Bug Fix Advisory: Red Hat build of Keycloak 26.2.4 Images Update

Severity

Moderate

Notes

Topic: New images are available for Red Hat build of Keycloak 26.2.4 and Red Hat build of Keycloak 26.2.4 Operator, running on OpenShift Container Platform

Details: Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.2.4 clusters. This erratum releases new images for Red Hat build of Keycloak 26.2.4 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2020-11023

A flaw was found in jQuery. HTML containing \<option\> elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: 9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x	—	Vendor Fix fix Workaround

Threats

Exploit Status CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Impact Moderate

CVE-2024-12397

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests

Affected products

Fixed 9 products, the same list as for CVE-2020-11023

Threats

Impact Moderate

CVE-2025-0395

A flaw was found in the GNU C Library (glibc). A buffer overflow condition via the `assert()` function may be triggered due to glibc not allocating enough space for the assertion failure message string and size information. In certain conditions, a local attacker can exploit this, potentially leading to an application crash or other undefined behavior.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 9 products, the same list as for CVE-2020-11023

Threats

Impact Moderate

References

17 references

URL	Category
https://access.redhat.com/errata/RHBA-2025:7639	self
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2020-11023	self
https://bugzilla.redhat.com/show_bug.cgi?id=1850004	external
https://www.cve.org/CVERecord?id=CVE-2020-11023	external
https://nvd.nist.gov/vuln/detail/CVE-2020-11023	external
https://blog.jquery.com/2020/04/10/jquery-3-5-0-r…	external
https://www.cisa.gov/known-exploited-vulnerabilit…	external
https://access.redhat.com/security/cve/CVE-2024-12397	self
https://bugzilla.redhat.com/show_bug.cgi?id=2331298	external
https://www.cve.org/CVERecord?id=CVE-2024-12397	external
https://nvd.nist.gov/vuln/detail/CVE-2024-12397	external
https://access.redhat.com/security/cve/CVE-2025-0395	self
https://bugzilla.redhat.com/show_bug.cgi?id=2339460	external
https://www.cve.org/CVERecord?id=CVE-2025-0395	external
https://nvd.nist.gov/vuln/detail/CVE-2025-0395	external
https://sourceware.org/bugzilla/show_bug.cgi?id=32582	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New images are available for Red Hat build of Keycloak 26.2.4 and Red Hat build of Keycloak 26.2.4 Operator, running on OpenShift Container Platform",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\nRed Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.2.4 clusters.\nThis erratum releases new images for Red Hat build of Keycloak 26.2.4 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2025:7639",
        "url": "https://access.redhat.com/errata/RHBA-2025:7639"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_7639.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: Red Hat build of Keycloak 26.2.4 Images Update",
    "tracking": {
      "current_release_date": "2026-11-01T04:50:41+00:00",
      "generator": {
        "date": "2026-11-01T04:50:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHBA-2025:7639",
      "initial_release_date": "2025-05-14T23:43:12+00:00",
      "revision_history": [
        {
          "date": "2025-05-14T23:43:12+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-05-14T23:43:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-01T04:50:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 26.2",
                "product": {
                  "name": "Red Hat build of Keycloak 26.2",
                  "product_id": "9Base-RHBK-26.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:26.2::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.2-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
                "product": {
                  "name": "rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
                  "product_id": "rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=26.2.4-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.2-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.2-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.2-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x",
                  "product_id": "rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.2-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.2-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.2-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.2-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64 as a component of Red Hat build of Keycloak 26.2",
          "product_id": "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64"
        },
        "product_reference": "rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le as a component of Red Hat build of Keycloak 26.2",
          "product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x as a component of Red Hat build of Keycloak 26.2",
          "product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64 as a component of Red Hat build of Keycloak 26.2",
          "product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64 as a component of Red Hat build of Keycloak 26.2",
          "product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64 as a component of Red Hat build of Keycloak 26.2",
          "product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le as a component of Red Hat build of Keycloak 26.2",
          "product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64 as a component of Red Hat build of Keycloak 26.2",
          "product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x as a component of Red Hat build of Keycloak 26.2",
          "product_id": "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-11023",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2020-06-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1850004"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-11023"
        },
        {
          "category": "external",
          "summary": "RHBZ#1850004",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023"
        },
        {
          "category": "external",
          "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/",
          "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2020-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-14T23:43:12+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:7639"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2025-01-23T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods"
    },
    {
      "cve": "CVE-2024-12397",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests"
      },
      "discovery_date": "2024-12-10T01:15:33.380000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331298"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with\ncertain value-delimiting characters in incoming requests. This issue could\nallow an attacker to construct a cookie value to exfiltrate HttpOnly cookie\nvalues or spoof arbitrary additional cookie values, leading to unauthorized\ndata access or modification. The main threat from this flaw impacts data\nconfidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability. This is a very similar vulnerability to an Undertow, seen in CVE-2023-4639.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-12397"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331298",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331298"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-12397",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-12397"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12397",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12397"
        }
      ],
      "release_date": "2024-12-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-14T23:43:12+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:7639"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling"
    },
    {
      "cve": "CVE-2025-0395",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2025-01-22T14:00:44.671153+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2339460"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GNU C Library (glibc). A buffer overflow condition via the `assert()` function may be triggered due to glibc not allocating enough space for the assertion failure message string and size information. In certain conditions, a local attacker can exploit this, potentially leading to an application crash or other undefined behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glibc: buffer overflow in the GNU C Library\u0027s assert()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The bug is with glib assert() function that is typically used to identify logic errors in programs. The specific vulnerability stems in not enough being allocated to fit an arbitrary length error statement that is passed to the assert() function. The lack of any check on the string length causes the buffer overflow.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
          "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-0395"
        },
        {
          "category": "external",
          "summary": "RHBZ#2339460",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339460"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-0395",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-0395"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-0395",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0395"
        },
        {
          "category": "external",
          "summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=32582",
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32582"
        }
      ],
      "release_date": "2025-01-22T13:11:30.406000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-14T23:43:12+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:7639"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.2:rhbk/keycloak-operator-bundle@sha256:d1179dd33823519f020e2e23e29681a8db5de0c9ee08072be6e182307d798c36_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:39f96c79ca38ca0a9f9cb619d05fb9c01652aadc632a17a0d74fa2a9aa132b23_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6d7407e729b9f5a95f76222adeb7feacd119a164bd249aa848b00ed6a0acb116_s390x",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:6e94aecaad4db3d9cca96ad8cfc8323bc41505f162b90e86a831e4809f22356b_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9-operator@sha256:dde7b6bee3e4a58f5f806d578c61bbabf3a43b8beb12348b0957c7368c96b99c_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:478963851f990b92f043c32c0ad5b12f9f0402079c154533ccf4f64921a05119_amd64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:8d2ad878990fba5501ecfd75e2c22bbbb65f073d5de069b01f43d48ae8050dd2_ppc64le",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:9f2d98413e1bafebedf7a25c1fd117d8fb8efdf6ac1fe4d825ec36e4d07f5581_arm64",
            "9Base-RHBK-26.2:rhbk/keycloak-rhel9@sha256:e698b2f8ab9b8da5b5cd6e3b645a9bcb1b91fef33c636911c2e1047fcb98b5e9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glibc: buffer overflow in the GNU C Library\u0027s assert()"
    }
  ]
}

CVE-2020-11023 (GCVE-0-2020-11023)

Vulnerability from cvelistv5 – Published: 2020-04-29 00:00 – Updated: 2025-10-21 23:35

Title

Potential XSS vulnerability in jQuery

Summary

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Severity

6.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: active Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-23 18:07 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8035 records in the last 180 days details

References

67 references

URL	Tags
https://www.debian.org/security/2020/dsa-4693	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://www.oracle.com/security-alerts/cpujul2020.html
https://jquery.com/upgrade-guide/3.5/
https://security.netapp.com/advisory/ntap-2020051…
https://www.drupal.org/sa-core-2020-002
https://github.com/jquery/jquery/security/advisor…
https://blog.jquery.com/2020/04/10/jquery-3-5-0-r…
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://security.gentoo.org/glsa/202007-03	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://lists.apache.org/thread.html/r094f4355955…	mailing-list
https://lists.apache.org/thread.html/rf661a90a15d…	mailing-list
https://lists.apache.org/thread.html/r9c5fda81e4b…	mailing-list
https://lists.apache.org/thread.html/ra3c9219fcb0…	mailing-list
https://lists.apache.org/thread.html/radcb2aa874a…	mailing-list
https://lists.apache.org/thread.html/rd38b4185a79…	mailing-list
https://lists.apache.org/thread.html/r6e97b379639…	mailing-list
https://lists.apache.org/thread.html/rb69b7d8217c…	mailing-list
https://lists.apache.org/thread.html/r4aadb98086c…	mailing-list
https://lists.apache.org/thread.html/ra374bb0299b…	mailing-list
https://lists.apache.org/thread.html/rb25c3bc7418…	mailing-list
https://lists.apache.org/thread.html/rf1ba79e564f…	mailing-list
https://lists.apache.org/thread.html/ra32c7103ded…	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.apache.org/thread.html/ra406b3adfcf…	mailing-list
https://lists.apache.org/thread.html/rab82dd040f3…	mailing-list
https://lists.apache.org/thread.html/r6c4df3b33e6…	mailing-list
https://lists.apache.org/thread.html/r1fed19c860a…	mailing-list
https://lists.apache.org/thread.html/r0593393ca1e…	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.apache.org/thread.html/rda99599896c…	mailing-list
https://www.oracle.com/security-alerts/cpuoct2020.html
https://lists.apache.org/thread.html/r706cfbc0984…	mailing-list
https://lists.apache.org/thread.html/rbb448222ba6…	mailing-list
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://lists.apache.org/thread.html/r49ce4243b47…	mailing-list
https://lists.apache.org/thread.html/r2c85121a474…	mailing-list
https://lists.apache.org/thread.html/r4dba67be323…	mailing-list
https://lists.apache.org/thread.html/r3702ede0ff8…	mailing-list
https://lists.apache.org/thread.html/r07ab379471f…	mailing-list
https://lists.apache.org/thread.html/r9e0bd31b7da…	mailing-list
https://lists.apache.org/thread.html/rf0f89395960…	mailing-list
https://lists.apache.org/thread.html/r9006ad2abf8…	mailing-list
https://lists.apache.org/thread.html/r55f5e066cc7…	mailing-list
https://www.oracle.com/security-alerts/cpujan2021.html
https://lists.apache.org/thread.html/r8f70b0f65d6…	mailing-list
https://lists.apache.org/thread.html/r564585d97bc…	mailing-list
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://lists.apache.org/thread.html/ree3bd8ddb23…	mailing-list
https://lists.apache.org/thread.html/rede9cfaa756…	mailing-list
https://lists.apache.org/thread.html/r54565a8f025…	mailing-list
https://lists.apache.org/thread.html/re4ae96fa5c1…	mailing-list
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.tenable.com/security/tns-2021-10
https://www.tenable.com/security/tns-2021-02
http://packetstormsecurity.com/files/162160/jQuer…
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://lists.apache.org/thread.html/r0483ba00727…	mailing-list
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://github.com/github/advisory-database/blob/…
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
jquery	jQuery	Affected: >= 1.0.3, < 3.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-23T21:07:47.681Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/github/advisory-database/blob/99afa6fdeaf5d1d23e1021ff915a5e5dbc82c1f1/advisories/github-reviewed/2020/04/GHSA-jpcq-cgw6-v4j6/GHSA-jpcq-cgw6-v4j6.json#L20-L37"
          },
          {
            "name": "DSA-4693",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4693"
          },
          {
            "name": "FEDORA-2020-36d2db5f51",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jquery.com/upgrade-guide/3.5/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200511-0006/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.drupal.org/sa-core-2020-002"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released"
          },
          {
            "name": "openSUSE-SU-2020:1060",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
          },
          {
            "name": "GLSA-202007-03",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202007-03"
          },
          {
            "name": "openSUSE-SU-2020:1106",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
          },
          {
            "name": "[hive-issues] 20200813 [jira] [Assigned] (HIVE-24039) update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-dev] 20200813 [jira] [Created] (HIVE-24039) update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200813 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-gitbox] 20200813 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200902 [jira] [Work started] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200902 [jira] [Commented] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200902 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200902 [jira] [Comment Edited] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200904 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E"
          },
          {
            "name": "[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E"
          },
          {
            "name": "[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E"
          },
          {
            "name": "[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E"
          },
          {
            "name": "FEDORA-2020-fbb94073a1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/"
          },
          {
            "name": "FEDORA-2020-0b32a59b54",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/"
          },
          {
            "name": "[hive-issues] 20200915 [jira] [Resolved] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-commits] 20200915 [hive] branch master updated: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 (#1403)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200915 [jira] [Work logged] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "[hive-gitbox] 20200915 [GitHub] [hive] kgyrtkirk merged pull request #1403: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E"
          },
          {
            "name": "[hive-issues] 20200915 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E"
          },
          {
            "name": "FEDORA-2020-fe94df8c34",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/"
          },
          {
            "name": "[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "name": "[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E"
          },
          {
            "name": "[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E"
          },
          {
            "name": "openSUSE-SU-2020:1888",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html"
          },
          {
            "name": "[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E"
          },
          {
            "name": "[felix-dev] 20201208 [jira] [Created] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E"
          },
          {
            "name": "[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E"
          },
          {
            "name": "[felix-dev] 20201208 [GitHub] [felix-dev] cziegeler merged pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E"
          },
          {
            "name": "[felix-dev] 20201208 [GitHub] [felix-dev] abhishekgarg18 opened a new pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E"
          },
          {
            "name": "[felix-dev] 20201208 [jira] [Commented] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E"
          },
          {
            "name": "[felix-dev] 20201208 [jira] [Assigned] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E"
          },
          {
            "name": "[felix-commits] 20201208 [felix-dev] branch master updated: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023 (#64)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E"
          },
          {
            "name": "[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.5.0 is vulnerable to CVE-2020-11023",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "name": "[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E"
          },
          {
            "name": "[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html"
          },
          {
            "name": "[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E"
          },
          {
            "name": "[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E"
          },
          {
            "name": "[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E"
          },
          {
            "name": "[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-10"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "name": "[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-11023",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-23T18:07:17.892570Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-01-23",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:35:45.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-01-23T00:00:00.000Z",
            "value": "CVE-2020-11023 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jQuery",
          "vendor": "jquery",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.3, \u003c 3.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-31T02:06:42.262Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "DSA-4693",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4693"
        },
        {
          "name": "FEDORA-2020-36d2db5f51",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "url": "https://jquery.com/upgrade-guide/3.5/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20200511-0006/"
        },
        {
          "url": "https://www.drupal.org/sa-core-2020-002"
        },
        {
          "url": "https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6"
        },
        {
          "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released"
        },
        {
          "name": "openSUSE-SU-2020:1060",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
        },
        {
          "name": "GLSA-202007-03",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202007-03"
        },
        {
          "name": "openSUSE-SU-2020:1106",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
        },
        {
          "name": "[hive-issues] 20200813 [jira] [Assigned] (HIVE-24039) update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-dev] 20200813 [jira] [Created] (HIVE-24039) update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200813 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-gitbox] 20200813 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200902 [jira] [Work started] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200902 [jira] [Commented] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200902 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200902 [jira] [Comment Edited] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200904 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E"
        },
        {
          "name": "[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E"
        },
        {
          "name": "[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E"
        },
        {
          "name": "[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E"
        },
        {
          "name": "FEDORA-2020-fbb94073a1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/"
        },
        {
          "name": "FEDORA-2020-0b32a59b54",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/"
        },
        {
          "name": "[hive-issues] 20200915 [jira] [Resolved] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-commits] 20200915 [hive] branch master updated: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 (#1403)",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200915 [jira] [Work logged] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "[hive-gitbox] 20200915 [GitHub] [hive] kgyrtkirk merged pull request #1403: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E"
        },
        {
          "name": "[hive-issues] 20200915 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E"
        },
        {
          "name": "FEDORA-2020-fe94df8c34",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/"
        },
        {
          "name": "[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "name": "[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E"
        },
        {
          "name": "[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E"
        },
        {
          "name": "openSUSE-SU-2020:1888",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html"
        },
        {
          "name": "[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E"
        },
        {
          "name": "[felix-dev] 20201208 [jira] [Created] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E"
        },
        {
          "name": "[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E"
        },
        {
          "name": "[felix-dev] 20201208 [GitHub] [felix-dev] cziegeler merged pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E"
        },
        {
          "name": "[felix-dev] 20201208 [GitHub] [felix-dev] abhishekgarg18 opened a new pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E"
        },
        {
          "name": "[felix-dev] 20201208 [jira] [Commented] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E"
        },
        {
          "name": "[felix-dev] 20201208 [jira] [Assigned] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E"
        },
        {
          "name": "[felix-commits] 20201208 [felix-dev] branch master updated: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023 (#64)",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E"
        },
        {
          "name": "[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.5.0 is vulnerable to CVE-2020-11023",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "name": "[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E"
        },
        {
          "name": "[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E"
        },
        {
          "name": "[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html"
        },
        {
          "name": "[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E"
        },
        {
          "name": "[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E"
        },
        {
          "name": "[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E"
        },
        {
          "name": "[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-10"
        },
        {
          "url": "https://www.tenable.com/security/tns-2021-02"
        },
        {
          "url": "http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html"
        },
        {
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "name": "[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
        }
      ],
      "source": {
        "advisory": "GHSA-jpcq-cgw6-v4j6",
        "discovery": "UNKNOWN"
      },
      "title": "Potential XSS vulnerability in jQuery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-11023",
    "datePublished": "2020-04-29T00:00:00.000Z",
    "dateReserved": "2020-03-30T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:35:45.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-12397 (GCVE-0-2024-12397)

Vulnerability from cvelistv5 – Published: 2024-12-12 09:05 – Updated: 2026-10-30 18:26

Title

Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

Summary

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-12 15:31 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1082 records in the last 180 days details

References

7 references

URL	Tags
https://access.redhat.com/errata/RHBA-2025:7525	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHBA-2025:7639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:0900	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:3018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8761	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-12397	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2331298	issue-trackingx_refsource_REDHAT

Impacted products

19 products

Vendor	Product	Version
		Affected: 0 , < 5.3.4 (semver)
Red Hat	Cryostat 4 on RHEL 9	Unaffected: 0.5.0-6 , < * (rpm) cpe:/a:redhat:cryostat:4::el9
Red Hat	Cryostat 4 on RHEL 9	Unaffected: 4.0.0-7 , < * (rpm) cpe:/a:redhat:cryostat:4::el9
Red Hat	HawtIO HawtIO 4.2.0	cpe:/a:redhat:apache_camel_hawtio:4.2::el6
Red Hat	Red Hat Build of Keycloak	cpe:/a:redhat:build_keycloak:26.2
Red Hat	Red Hat build of Keycloak 26.2	Unaffected: 26.2.4-2 , < * (rpm) cpe:/a:redhat:build_keycloak:26.2::el9
Red Hat	Red Hat build of Keycloak 26.2	Unaffected: 26.2-3 , < * (rpm) cpe:/a:redhat:build_keycloak:26.2::el9
Red Hat	Red Hat build of Quarkus 3.15.3	cpe:/a:redhat:quarkus:3.15
Red Hat	Cryostat 3	cpe:/a:redhat:cryostat:3
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	cpe:/a:redhat:camel_quarkus:3
Red Hat	Red Hat build of Apicurio Registry 2	cpe:/a:redhat:service_registry:2
Red Hat	Red Hat Build of Keycloak	cpe:/a:redhat:build_keycloak:
Red Hat	Red Hat build of OptaPlanner 8	cpe:/a:redhat:optaplanner:::el6
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat Integration Camel K 1	cpe:/a:redhat:integration:1
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	streams for Apache Kafka	cpe:/a:redhat:amq_streams:1

Date Public

2024-12-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T15:31:47.316503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T15:45:08.143Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/quarkusio/quarkus-http",
          "defaultStatus": "unaffected",
          "packageName": "quarkus-http",
          "versions": [
            {
              "lessThan": "5.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-agent-init-rhel9",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.5.0-6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-db-rhel9",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-grafana-dashboard-rhel9",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-openshift-console-plugin-rhel9",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-operator-bundle",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-ose-oauth-proxy-rhel9",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-reports-rhel9",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-rhel9",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-rhel9-operator",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/cryostat-storage-rhel9",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cryostat:4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat/jfr-datasource-rhel9",
          "product": "Cryostat 4 on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.0.0-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apache_camel_hawtio:4.2::el6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "quarkus-http-core",
          "product": "HawtIO HawtIO 4.2.0",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.2"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat Build of Keycloak",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.2.4-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.2-3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.2-3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:quarkus:3.15"
          ],
          "defaultStatus": "unaffected",
          "packageName": "quarkus-http-core",
          "product": "Red Hat build of Quarkus 3.15.3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:cryostat:3"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-http-core",
          "product": "Cryostat 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:3"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-camel-bom",
          "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:3"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-cxf-bom",
          "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_registry:2"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-http-core",
          "product": "Red Hat build of Apicurio Registry 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-http-core",
          "product": "Red Hat Build of Keycloak",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:optaplanner:::el6"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-http-core",
          "product": "Red Hat build of OptaPlanner 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "quarkus-http-core",
          "product": "Red Hat Fuse 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:integration:1"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-http-core",
          "product": "Red Hat Integration Camel K 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "quarkus-http-core",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "defaultStatus": "unaffected",
          "packageName": "quarkus-http-core",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-http-core",
          "product": "Red Hat Process Automation 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:amq_streams:1"
          ],
          "defaultStatus": "affected",
          "packageName": "quarkus-http-core",
          "product": "streams for Apache Kafka",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-12-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with\ncertain value-delimiting characters in incoming requests. This issue could\nallow an attacker to construct a cookie value to exfiltrate HttpOnly cookie\nvalues or spoof arbitrary additional cookie values, leading to unauthorized\ndata access or modification. The main threat from this flaw impacts data\nconfidentiality and integrity."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T18:26:42.413Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHBA-2025:7525",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2025:7525"
        },
        {
          "name": "RHBA-2025:7639",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2025:7639"
        },
        {
          "name": "RHSA-2025:0900",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0900"
        },
        {
          "name": "RHSA-2025:3018",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3018"
        },
        {
          "name": "RHSA-2025:8761",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:8761"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-12397"
        },
        {
          "name": "RHBZ#2331298",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331298"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-12-10T01:15:33.380Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-12-10T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling",
      "workarounds": [
        {
          "lang": "en",
          "value": "Currently, no mitigation is available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-12397",
    "datePublished": "2024-12-12T09:05:28.451Z",
    "dateReserved": "2024-12-10T01:22:12.303Z",
    "dateUpdated": "2026-10-30T18:26:42.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-0395 (GCVE-0-2025-0395)

Vulnerability from cvelistv5 – Published: 2025-01-22 13:11 – Updated: 2026-10-15 01:01

Summary

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-04 20:45 UTC

CWE

CWE-131 - Incorrect Calculation of Buffer Size

Assigner

glibc CNA under the redhat root

CNA scorecard B 80/100 over 13 records in the last 180 days details

References

12 references

URL	Tags
https://www.openwall.com/lists/oss-security/2025/…
https://sourceware.org/bugzilla/show_bug.cgi?id=32582
https://sourceware.org/git/?p=glibc.git;a=blob;f=…
https://sourceware.org/pipermail/libc-announce/20…
http://www.openwall.com/lists/oss-security/2025/01/22/4
http://www.openwall.com/lists/oss-security/2025/01/23/2
https://security.netapp.com/advisory/ntap-2025022…
http://www.openwall.com/lists/oss-security/2025/04/13/1
http://www.openwall.com/lists/oss-security/2025/04/24/7
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

15 products

Vendor	Product	Version
The GNU C Library	glibc	Affected: 2.13 , ≤ 2.40 (custom)
Siemens	RUGGEDCOM ROX MX5000	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX MX5000RE	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX RX1400	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX RX1500	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX RX1501	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX RX1510	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX RX1511	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX RX1512	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX RX1524	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX RX1536	Affected: 0 , < V2.17.1 (custom)
Siemens	RUGGEDCOM ROX RX5000	Affected: 0 , < V2.17.1 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)

Credits

Qualys Security Advisory

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-30T05:03:13.011Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/01/22/4"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/01/23/2"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250228-0006/"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/04/13/1"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/04/24/7"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00039.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-0395",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-04T20:45:32.215090Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-04T20:45:35.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000RE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1400",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1500",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1501",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1510",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1511",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1512",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1524",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1536",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:01:52.824Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThanOrEqual": "2.40",
              "status": "affected",
              "version": "2.13",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Qualys Security Advisory"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.\u003cbr\u003e"
            }
          ],
          "value": "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "CWE-131 Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-22T15:29:51.366Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2025/01/22/4"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32582"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2025-0001"
        },
        {
          "url": "https://sourceware.org/pipermail/libc-announce/2025/000044.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2025-0395",
    "datePublished": "2025-01-22T13:11:30.406Z",
    "dateReserved": "2025-01-11T15:00:14.787Z",
    "dateUpdated": "2026-10-15T01:01:52.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHBA-2025:7639

CVE-2020-11023 (GCVE-0-2020-11023)

CVE-2024-12397 (GCVE-0-2024-12397)

CVE-2025-0395 (GCVE-0-2025-0395)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour