ID

VAR-202201-0104


CVE

CVE-2021-45960


TITLE

Expat  calculation error vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-017469

DESCRIPTION

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). Expat ( alias libexpat) contains a computational error vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Expat is a fast streaming XML parser written in C. No detailed vulnerability details were provided at this time. Summary: The Migration Toolkit for Containers (MTC) 1.5.4 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Security Fix(es): * golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Solution: For details on how to install and use MTC, refer to: https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html 4. Bugs fixed (https://bugzilla.redhat.com/): 1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic 5. Description: Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Bugs fixed (https://bugzilla.redhat.com/): 2062751 - CVE-2022-24730 argocd: path traversal and improper access control allows leaking out-of-bound files 2062755 - CVE-2022-24731 argocd: path traversal allows leaking out-of-bound files 2064682 - CVE-2022-1025 Openshift-Gitops: Improper access control allows admin privilege escalation 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Advanced Cluster Management 2.3.8 security and container updates Advisory ID: RHSA-2022:1083-01 Product: Red Hat ACM Advisory URL: https://access.redhat.com/errata/RHSA-2022:1083 Issue date: 2022-03-28 CVE Names: CVE-2021-0920 CVE-2021-3999 CVE-2021-4154 CVE-2021-23177 CVE-2021-23566 CVE-2021-31566 CVE-2021-45960 CVE-2021-46143 CVE-2022-0144 CVE-2022-0155 CVE-2022-0235 CVE-2022-0261 CVE-2022-0318 CVE-2022-0330 CVE-2022-0359 CVE-2022-0361 CVE-2022-0392 CVE-2022-0413 CVE-2022-0435 CVE-2022-0492 CVE-2022-0516 CVE-2022-0536 CVE-2022-0847 CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827 CVE-2022-22942 CVE-2022-23218 CVE-2022-23219 CVE-2022-23308 CVE-2022-23852 CVE-2022-25235 CVE-2022-25236 CVE-2022-25315 ===================================================================== 1. Summary: Red Hat Advanced Cluster Management for Kubernetes 2.3.8 General Availability release images, which provide security and container updates. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Advanced Cluster Management for Kubernetes 2.3.8 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/ Security updates: * nanoid: Information disclosure via valueOf() function (CVE-2021-23566) * nodejs-shelljs: improper privilege management (CVE-2022-0144) * follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155) * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235) * follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536) Bug fix: * RHACM 2.3.8 images (Bugzilla #2062316) 3. Solution: For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/index For details on how to apply this update, refer to: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html-single/install/index#installing 4. Bugs fixed (https://bugzilla.redhat.com/): 2043535 - CVE-2022-0144 nodejs-shelljs: improper privilege management 2044556 - CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor 2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor 2050853 - CVE-2021-23566 nanoid: Information disclosure via valueOf() function 2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak 2062316 - RHACM 2.3.8 images 5. References: https://access.redhat.com/security/cve/CVE-2021-0920 https://access.redhat.com/security/cve/CVE-2021-3999 https://access.redhat.com/security/cve/CVE-2021-4154 https://access.redhat.com/security/cve/CVE-2021-23177 https://access.redhat.com/security/cve/CVE-2021-23566 https://access.redhat.com/security/cve/CVE-2021-31566 https://access.redhat.com/security/cve/CVE-2021-45960 https://access.redhat.com/security/cve/CVE-2021-46143 https://access.redhat.com/security/cve/CVE-2022-0144 https://access.redhat.com/security/cve/CVE-2022-0155 https://access.redhat.com/security/cve/CVE-2022-0235 https://access.redhat.com/security/cve/CVE-2022-0261 https://access.redhat.com/security/cve/CVE-2022-0318 https://access.redhat.com/security/cve/CVE-2022-0330 https://access.redhat.com/security/cve/CVE-2022-0359 https://access.redhat.com/security/cve/CVE-2022-0361 https://access.redhat.com/security/cve/CVE-2022-0392 https://access.redhat.com/security/cve/CVE-2022-0413 https://access.redhat.com/security/cve/CVE-2022-0435 https://access.redhat.com/security/cve/CVE-2022-0492 https://access.redhat.com/security/cve/CVE-2022-0516 https://access.redhat.com/security/cve/CVE-2022-0536 https://access.redhat.com/security/cve/CVE-2022-0847 https://access.redhat.com/security/cve/CVE-2022-22822 https://access.redhat.com/security/cve/CVE-2022-22823 https://access.redhat.com/security/cve/CVE-2022-22824 https://access.redhat.com/security/cve/CVE-2022-22825 https://access.redhat.com/security/cve/CVE-2022-22826 https://access.redhat.com/security/cve/CVE-2022-22827 https://access.redhat.com/security/cve/CVE-2022-22942 https://access.redhat.com/security/cve/CVE-2022-23218 https://access.redhat.com/security/cve/CVE-2022-23219 https://access.redhat.com/security/cve/CVE-2022-23308 https://access.redhat.com/security/cve/CVE-2022-23852 https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/index https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html-single/install/index#installing 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYkIo2dzjgjWX9erEAQhzdRAApzusRXUC+F2IeIQYZGDmY0HErMJjF6P8 NqLzhtVqzqrZB++i3JbWHcGR2SPKAPfyDrPBDYUH8l/BRVdjta5a50D6TX+D5nxl CQLiApm2/m67F8hRHZCVL8CdorXUiV15lacbUMdfpuEKL6xuKM7bafBLBqUojdyA T/hYI6se1bcO848DFW3lIft8wsQhvkxdJB4MUx73DhaTU6OpOb1rbokEOsGMEf7r rAHsEqsa0HXELBGnYrOfo9iBqXxCdbRHzqfHnsjIFegq6mTabjWi6q+95KFOmT5s z5mym/smRxFlchAjNonna4MiJCX4ko0wBdL5Dis7ZbjEF+f92TLaHElBczvKB695 hMK8ujF7/p+mHl44PSyQw3uDzIAqGH3aZJBUggeJ1ECueUu/FdRNbsQW7L8OX0i6 Aryhgxi2TS7MgfUPQJ1gz2oPa9wZHGtibczYuOIGFTTLNG/5+oZRfgxqn8kTQWhR 1lTGMAHbkrW2++5ZCbksrGVJZXxQWwaKq9HpofAzlAngTEBo2Xf1BCKN05/ZWZmO 0PopgYCzlWkZVnCSbXAyFnYg1lm5BgHA9PKEG+w1+6klG6YN1T2EPlPFQrDNfoka K7ieQGJGafmME/Rd70Sz1F1NW+tkDgvRjQ60A59fIDmN99tDzpQEp/DkUgFwXGzZ Frbe7GnlRyc= =hLEP -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202209-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Expat: Multiple Vulnerabilities Date: September 29, 2022 Bugs: #791703, #830422, #831918, #833431, #870097 ID: 202209-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in Expat, the worst of which could result in arbitrary code execution. Background ========= Expat is a set of XML parsing libraries. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/expat < 2.4.9 >= 2.4.9 Description ========== Multiple vulnerabilities have been discovered in Expat. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Expat users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">\xdev-libs/expat-2.4.9" References ========= [ 1 ] CVE-2021-45960 https://nvd.nist.gov/vuln/detail/CVE-2021-45960 [ 2 ] CVE-2021-46143 https://nvd.nist.gov/vuln/detail/CVE-2021-46143 [ 3 ] CVE-2022-22822 https://nvd.nist.gov/vuln/detail/CVE-2022-22822 [ 4 ] CVE-2022-22823 https://nvd.nist.gov/vuln/detail/CVE-2022-22823 [ 5 ] CVE-2022-22824 https://nvd.nist.gov/vuln/detail/CVE-2022-22824 [ 6 ] CVE-2022-22825 https://nvd.nist.gov/vuln/detail/CVE-2022-22825 [ 7 ] CVE-2022-22826 https://nvd.nist.gov/vuln/detail/CVE-2022-22826 [ 8 ] CVE-2022-22827 https://nvd.nist.gov/vuln/detail/CVE-2022-22827 [ 9 ] CVE-2022-23852 https://nvd.nist.gov/vuln/detail/CVE-2022-23852 [ 10 ] CVE-2022-23990 https://nvd.nist.gov/vuln/detail/CVE-2022-23990 [ 11 ] CVE-2022-25235 https://nvd.nist.gov/vuln/detail/CVE-2022-25235 [ 12 ] CVE-2022-25236 https://nvd.nist.gov/vuln/detail/CVE-2022-25236 [ 13 ] CVE-2022-25313 https://nvd.nist.gov/vuln/detail/CVE-2022-25313 [ 14 ] CVE-2022-25314 https://nvd.nist.gov/vuln/detail/CVE-2022-25314 [ 15 ] CVE-2022-25315 https://nvd.nist.gov/vuln/detail/CVE-2022-25315 [ 16 ] CVE-2022-40674 https://nvd.nist.gov/vuln/detail/CVE-2022-40674 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202209-24 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . For the oldstable distribution (buster), these problems have been fixed in version 2.2.6-2+deb10u2. For the stable distribution (bullseye), these problems have been fixed in version 2.2.10-2+deb11u1. We recommend that you upgrade your expat packages. For the detailed security status of expat please refer to its security tracker page at: https://security-tracker.debian.org/tracker/expat Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmIHtfRfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0R5Uw/8Cx7ErfU/j1OgJxyfoRH3/Rz5YNCRzmEzjg7Uh8ZuJl6WfkcvcKvYlCoi /RtUOzYfk2Zg7NHXE86TWOWtbxU1n16n22XwhpbLHAIPuw1GhvwDG6Ctt8U3YAaJ zBReZvw3NSxWJdOD7rTJlAtlQcFpHSUJd2jWjcggZCfySduYMKwLYNzt5+eruwpe YhPKDdZH/MUMe0zOV43qfyYTeP7bqCbpnyhZXk8cNC39SzrJnXwovn7eKmFFCW5x g/ptvOIBJVzh3LxemMyWF4qomQ1rRxGWbkXx46cUQ7alyTcExMnIwBfpzJYCpAKC XV9FvhGS0sfug9NelY9+xpQAvrfCYToHW5niA6OzPuP/Lf7AAWinmGNpxTlYWQcF 1ZxOEQbv8XGikfM74pEsSjIkFwjkLQEFfETaImsvonZf6A3IIhLqkSBsS+j7LNcl ht3uMiJIXkn+iJyDYcCaB0PhgPAqBVk/wk9X01sygzMNrFrYfcX8CeALq5uaZkl6 ut1wYIirLFRKIhuHdGsmt/NKyFIJTzfmaL2W0nvAdLFVxPZQwIzaGxUALo04O+Zn AQj2/JbsAiO2p/N5CXEwtyBNzmJNqlzPlcZ+42uuo/nvsscw2QAL+Yk88XZKwx1B QS4zjj7Lf38+ATT5CFR8m8MTjlv4pUVnYABjx+8LX3pDS3QH4mM= =hLGY -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2021-45960 // JVNDB: JVNDB-2021-017469 // VULHUB: VHN-410670 // PACKETSTORM: 166789 // PACKETSTORM: 166433 // PACKETSTORM: 166516 // PACKETSTORM: 168578 // PACKETSTORM: 169217

AFFECTED PRODUCTS

vendor:netappmodel:oncommand workflow automationscope:eqversion: -

Trust: 1.0

vendor:tenablemodel:nessusscope:gteversion:10.0.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:11.0

Trust: 1.0

vendor:netappmodel:solidfire \& hci management nodescope:eqversion: -

Trust: 1.0

vendor:tenablemodel:nessusscope:ltversion:8.15.3

Trust: 1.0

vendor:netappmodel:active iq unified managerscope:eqversion: -

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:netappmodel:hci baseboard management controllerscope:eqversion:h610c

Trust: 1.0

vendor:libexpatmodel:libexpatscope:ltversion:2.4.3

Trust: 1.0

vendor:tenablemodel:nessusscope:ltversion:10.1.1

Trust: 1.0

vendor:netappmodel:hci baseboard management controllerscope:eqversion:h610s

Trust: 1.0

vendor:netappmodel:hci baseboard management controllerscope:eqversion:h615c

Trust: 1.0

vendor:siemensmodel:sinema remote connect serverscope:ltversion:3.1

Trust: 1.0

vendor:netappmodel:active iq unified managerscope: - version: -

Trust: 0.8

vendor:libexpatmodel:libexpatscope: - version: -

Trust: 0.8

vendor:netappmodel:oncommand workflow automationscope: - version: -

Trust: 0.8

vendor:debianmodel:gnu/linuxscope: - version: -

Trust: 0.8

vendor:tenablemodel:nessusscope: - version: -

Trust: 0.8

vendor:netappmodel:solidfire & hci management nodescope: - version: -

Trust: 0.8

vendor:日立model:日立高信頼サーバ rv3000scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:sinema remote connect serverscope: - version: -

Trust: 0.8

vendor:netappmodel:hci baseboard management controllerscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-017469 // NVD: CVE-2021-45960

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-45960
value: HIGH

Trust: 1.0

NVD: CVE-2021-45960
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202201-037
value: HIGH

Trust: 0.6

VULHUB: VHN-410670
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-45960
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-410670
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-45960
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-45960
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-410670 // JVNDB: JVNDB-2021-017469 // CNNVD: CNNVD-202201-037 // NVD: CVE-2021-45960

PROBLEMTYPE DATA

problemtype:CWE-682

Trust: 1.1

problemtype:calculation error (CWE-682) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-410670 // JVNDB: JVNDB-2021-017469 // NVD: CVE-2021-45960

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202201-037

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202201-037

PATCH

title:SSA-484086 Hitachi Server / Client Product Security Informationurl:https://www.debian.org/security/2022/dsa-5073

Trust: 0.8

title:Expat Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=177177

Trust: 0.6

sources: JVNDB: JVNDB-2021-017469 // CNNVD: CNNVD-202201-037

EXTERNAL IDS

db:NVDid:CVE-2021-45960

Trust: 3.8

db:OPENWALLid:OSS-SECURITY/2022/01/17/3

Trust: 1.7

db:SIEMENSid:SSA-484086

Trust: 1.7

db:TENABLEid:TNS-2022-05

Trust: 1.7

db:ICS CERTid:ICSA-22-167-17

Trust: 1.4

db:PACKETSTORMid:168578

Trust: 0.8

db:PACKETSTORMid:166516

Trust: 0.8

db:ICS CERTid:ICSA-23-278-01

Trust: 0.8

db:JVNid:JVNVU99030761

Trust: 0.8

db:JVNid:JVNVU97425465

Trust: 0.8

db:JVNDBid:JVNDB-2021-017469

Trust: 0.8

db:PACKETSTORMid:167008

Trust: 0.7

db:PACKETSTORMid:166496

Trust: 0.7

db:PACKETSTORMid:166976

Trust: 0.7

db:PACKETSTORMid:166348

Trust: 0.7

db:PACKETSTORMid:169541

Trust: 0.7

db:PACKETSTORMid:166437

Trust: 0.7

db:CS-HELPid:SB2022072065

Trust: 0.6

db:CS-HELPid:SB2022072710

Trust: 0.6

db:CS-HELPid:SB2022060617

Trust: 0.6

db:CS-HELPid:SB2022032843

Trust: 0.6

db:CS-HELPid:SB2022072608

Trust: 0.6

db:CS-HELPid:SB2022061216

Trust: 0.6

db:CS-HELPid:SB2022041954

Trust: 0.6

db:CS-HELPid:SB2022032013

Trust: 0.6

db:CS-HELPid:SB2022011713

Trust: 0.6

db:CS-HELPid:SB2022031627

Trust: 0.6

db:CS-HELPid:SB2022022416

Trust: 0.6

db:CS-HELPid:SB2022070605

Trust: 0.6

db:CS-HELPid:SB2022020902

Trust: 0.6

db:CS-HELPid:SB2022021418

Trust: 0.6

db:CS-HELPid:SB2022033002

Trust: 0.6

db:CS-HELPid:SB2022032445

Trust: 0.6

db:CS-HELPid:SB2022042116

Trust: 0.6

db:PACKETSTORMid:166088

Trust: 0.6

db:PACKETSTORMid:166812

Trust: 0.6

db:AUSCERTid:ESB-2022.0626

Trust: 0.6

db:AUSCERTid:ESB-2022.4174

Trust: 0.6

db:AUSCERTid:ESB-2022.1154

Trust: 0.6

db:AUSCERTid:ESB-2022.1677

Trust: 0.6

db:AUSCERTid:ESB-2022.1263

Trust: 0.6

db:AUSCERTid:ESB-2022.3299

Trust: 0.6

db:AUSCERTid:ESB-2022.5666

Trust: 0.6

db:AUSCERTid:ESB-2022.0369

Trust: 0.6

db:AUSCERTid:ESB-2022.2165

Trust: 0.6

db:AUSCERTid:ESB-2022.0749

Trust: 0.6

db:CNNVDid:CNNVD-202201-037

Trust: 0.6

db:PACKETSTORMid:166433

Trust: 0.2

db:PACKETSTORMid:166431

Trust: 0.1

db:PACKETSTORMid:169540

Trust: 0.1

db:CNVDid:CNVD-2022-05481

Trust: 0.1

db:VULHUBid:VHN-410670

Trust: 0.1

db:PACKETSTORMid:166789

Trust: 0.1

db:PACKETSTORMid:169217

Trust: 0.1

sources: VULHUB: VHN-410670 // JVNDB: JVNDB-2021-017469 // PACKETSTORM: 166789 // PACKETSTORM: 166433 // PACKETSTORM: 166516 // PACKETSTORM: 168578 // PACKETSTORM: 169217 // CNNVD: CNNVD-202201-037 // NVD: CVE-2021-45960

REFERENCES

url:https://security.gentoo.org/glsa/202209-24

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-45960

Trust: 1.8

url:https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Trust: 1.7

url:https://security.netapp.com/advisory/ntap-20220121-0004/

Trust: 1.7

url:https://www.tenable.com/security/tns-2022-05

Trust: 1.7

url:https://www.debian.org/security/2022/dsa-5073

Trust: 1.7

url:https://bugzilla.mozilla.org/show_bug.cgi?id=1217609

Trust: 1.7

url:https://github.com/libexpat/libexpat/issues/531

Trust: 1.7

url:https://github.com/libexpat/libexpat/pull/534

Trust: 1.7

url:http://www.openwall.com/lists/oss-security/2022/01/17/3

Trust: 1.7

url:https://jvn.jp/vu/jvnvu99030761/index.html

Trust: 0.8

url:https://jvn.jp/vu/jvnvu97425465/index.html

Trust: 0.8

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-17

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-01

Trust: 0.8

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-167-17

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072710

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022031627

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1154

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022022416

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022041954

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022061216

Trust: 0.6

url:https://packetstormsecurity.com/files/166976/red-hat-security-advisory-2022-1734-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022020902

Trust: 0.6

url:https://packetstormsecurity.com/files/166516/red-hat-security-advisory-2022-1083-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.4174

Trust: 0.6

url:https://packetstormsecurity.com/files/169541/red-hat-security-advisory-2022-7143-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022021418

Trust: 0.6

url:https://packetstormsecurity.com/files/166348/red-hat-security-advisory-2022-0951-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032843

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022070605

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072608

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.5666

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032445

Trust: 0.6

url:https://vigilance.fr/vulnerability/expat-memory-corruption-via-storeatts-37269

Trust: 0.6

url:https://packetstormsecurity.com/files/166496/red-hat-security-advisory-2022-1069-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/168578/gentoo-linux-security-advisory-202209-24.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072065

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1263

Trust: 0.6

url:https://packetstormsecurity.com/files/166088/ubuntu-security-notice-usn-5288-1.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022060617

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022042116

Trust: 0.6

url:https://packetstormsecurity.com/files/166812/red-hat-security-advisory-2022-1476-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032013

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022033002

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011713

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0749

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.2165

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0626

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.3299

Trust: 0.6

url:https://packetstormsecurity.com/files/167008/red-hat-security-advisory-2022-1747-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/166437/red-hat-security-advisory-2022-1039-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0369

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1677

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2022-22825

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22823

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22824

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-22822

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-46143

Trust: 0.4

url:https://access.redhat.com/security/cve/cve-2022-25315

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-25236

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-25235

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-23308

Trust: 0.3

url:https://bugzilla.redhat.com/):

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-23852

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22822

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22823

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22827

Trust: 0.3

url:https://access.redhat.com/security/team/contact/

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0392

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0261

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2021-31566

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22826

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-23177

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2021-3999

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0413

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-23219

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22824

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2021-45960

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-23218

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22825

Trust: 0.3

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2021-23177

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2021-46143

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-31566

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0361

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0359

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0318

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22826

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22827

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-23852

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-0492

Trust: 0.2

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-4154

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-0920

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0847

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0435

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-22942

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0330

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0516

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-24407

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-0920

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0361

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0261

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0318

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-3999

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-25236

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0413

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-25235

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0359

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0392

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23990

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-22925

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-19603

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25710

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-20838

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-21684

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-12762

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36085

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-16135

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36084

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-25710

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-20231

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-20232

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-28153

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-41190

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3445

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36086

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4122

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-17594

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36087

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22898

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-42574

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-5827

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-19603

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-18218

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14155

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-13435

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-33560

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-16135

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-14155

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-25709

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-17595

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-13751

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3426

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22817

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3572

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-20232

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-20838

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-22925

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44716

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1396

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-17594

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-22876

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-13750

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-12762

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-3577

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-13435

Trust: 0.1

url:https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-36221

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-28153

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-18218

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0532

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22876

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2014-3577

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-22898

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22816

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3580

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3800

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-21684

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-13751

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-17595

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3200

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-24370

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-20231

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-24370

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0778

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-5827

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-13750

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3521

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25709

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44717

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-1025

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1041

Trust: 0.1

url:https://access.redhat.com/articles/11258

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23219

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24407

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24731

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23218

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24730

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23308

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24731

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24730

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-1025

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0235

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0155

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0235

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0516

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0536

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html-single/install/index#installing

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/index

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0492

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0536

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1083

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0144

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-23566

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0435

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0847

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0330

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-4154

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0144

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-23566

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0155

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-25315

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-40674

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-25314

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-25313

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

url:https://security-tracker.debian.org/tracker/expat

Trust: 0.1

sources: VULHUB: VHN-410670 // JVNDB: JVNDB-2021-017469 // PACKETSTORM: 166789 // PACKETSTORM: 166433 // PACKETSTORM: 166516 // PACKETSTORM: 168578 // PACKETSTORM: 169217 // CNNVD: CNNVD-202201-037 // NVD: CVE-2021-45960

CREDITS

Siemens notified CISA of these vulnerabilities.

Trust: 0.6

sources: CNNVD: CNNVD-202201-037

SOURCES

db:VULHUBid:VHN-410670
db:JVNDBid:JVNDB-2021-017469
db:PACKETSTORMid:166789
db:PACKETSTORMid:166433
db:PACKETSTORMid:166516
db:PACKETSTORMid:168578
db:PACKETSTORMid:169217
db:CNNVDid:CNNVD-202201-037
db:NVDid:CVE-2021-45960

LAST UPDATE DATE

2024-11-20T21:01:33.775000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-410670date:2022-10-06T00:00:00
db:JVNDBid:JVNDB-2021-017469date:2023-10-10T05:50:00
db:CNNVDid:CNNVD-202201-037date:2022-11-09T00:00:00
db:NVDid:CVE-2021-45960date:2022-10-06T19:08:03.287

SOURCES RELEASE DATE

db:VULHUBid:VHN-410670date:2022-01-01T00:00:00
db:JVNDBid:JVNDB-2021-017469date:2023-01-19T00:00:00
db:PACKETSTORMid:166789date:2022-04-20T15:12:33
db:PACKETSTORMid:166433date:2022-03-24T14:36:50
db:PACKETSTORMid:166516date:2022-03-29T15:53:19
db:PACKETSTORMid:168578date:2022-09-30T14:56:43
db:PACKETSTORMid:169217date:2022-02-28T20:12:00
db:CNNVDid:CNNVD-202201-037date:2022-01-01T00:00:00
db:NVDid:CVE-2021-45960date:2022-01-01T19:15:08.030