Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2014-8991 (GCVE-0-2014-8991)
Vulnerability from cvelistv5
- n/a
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T13:33:12.668Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "[oss-security] 20141117 Requesting a CVE for pip - Local DoS with predictable temp directory names", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847" }, { "name": "71209", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/71209" }, { "name": "[oss-security] 20141120 Re: Requesting a CVE for pip - Local DoS with predictable temp directory names", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/pypa/pip/pull/2122" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2014-11-11T00:00:00", "descriptions": [ { "lang": "en", "value": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2016-10-17T13:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "[oss-security] 20141117 Requesting a CVE for pip - Local DoS with predictable temp directory names", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847" }, { "name": "71209", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/71209" }, { "name": "[oss-security] 20141120 Re: Requesting a CVE for pip - Local DoS with predictable temp directory names", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/pypa/pip/pull/2122" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-8991", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "[oss-security] 20141117 Requesting a CVE for pip - Local DoS with predictable temp directory names", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17" }, { "name": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" }, { "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847", "refsource": "CONFIRM", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847" }, { "name": "71209", "refsource": "BID", "url": "http://www.securityfocus.com/bid/71209" }, { "name": "[oss-security] 20141120 Re: Requesting a CVE for pip - Local DoS with predictable temp directory names", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6" }, { "name": "https://github.com/pypa/pip/pull/2122", "refsource": "CONFIRM", "url": "https://github.com/pypa/pip/pull/2122" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-8991", "datePublished": "2014-11-24T15:00:00", "dateReserved": "2014-11-19T00:00:00", "dateUpdated": "2024-08-06T13:33:12.668Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2014-8991\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2014-11-24T15:59:15.640\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.\"},{\"lang\":\"es\",\"value\":\"pip 1.3 hasta 1.5.6 permite a usuarios locales causar una denegaci\u00f3n de servicio (prevenci\u00f3n de la instalaci\u00f3n de paquetes) mediante la creaci\u00f3n de un fichero /tmp/pip-build-* para otro usuario.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.3\",\"versionEndIncluding\":\"1.5.6\",\"matchCriteriaId\":\"C2B311CF-E147-4A9D-A90F-E5CC6B9A3AEE\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B1C288F-326B-497B-B26C-D26E01262DDB\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2014/11/19/17\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2014/11/20/6\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/71209\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/pypa/pip/pull/2122\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2014/11/19/17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2014/11/20/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/71209\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/pypa/pip/pull/2122\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}" } }
pysec-2014-11
Vulnerability from pysec
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
Name | purl | pip | pkg:pypi/pip |
---|
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "pip", "purl": "pkg:pypi/pip" }, "ranges": [ { "events": [ { "introduced": "1.3" }, { "fixed": "6.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.3", "1.3.1", "1.4", "1.4.1", "1.5", "1.5.1", "1.5.2", "1.5.3", "1.5.4", "1.5.5", "1.5.6" ] } ], "aliases": [ "CVE-2014-8991" ], "details": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "id": "PYSEC-2014-11", "modified": "2021-07-05T00:01:24.413265Z", "published": "2014-11-24T15:59:00Z", "references": [ { "type": "WEB", "url": "https://github.com/pypa/pip/pull/2122" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/71209" }, { "type": "WEB", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6" }, { "type": "WEB", "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" } ] }
suse-fu-2021:2130-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Feature implementation for python39-pip, python39-setuptools", "title": "Title of the patch" }, { "category": "description", "text": "This update for python39-pip, python39-setuptools fixes the following issues:\n\nChanges in python39-setuptools:\n\n- Provide `python39-setuptools` version 44.1.1 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)\n\nChanges in python39-pip:\n\n- Provide `python39-pip` version 20.2.4 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)\n\n ", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-2021-2130,SUSE-SLE-Module-Basesystem-15-SP3-2021-2130", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-fu-2021_2130-1.json" }, { "category": "self", "summary": "URL for SUSE-FU-2021:2130-1", "url": "https://www.suse.com/support/update/announcement//suse-fu-20212130-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-FU-2021:2130-1", "url": "https://lists.suse.com/pipermail/sle-updates/2021-June/019414.html" }, { "category": "self", "summary": "SUSE Bug 1176262", "url": "https://bugzilla.suse.com/1176262" }, { "category": "self", "summary": "SUSE Bug 1177127", "url": "https://bugzilla.suse.com/1177127" }, { "category": "self", "summary": "SUSE Bug 1187170", "url": "https://bugzilla.suse.com/1187170" }, { "category": "self", "summary": "SUSE Bug 428177", "url": "https://bugzilla.suse.com/428177" }, { "category": "self", "summary": "SUSE Bug 842516", "url": "https://bugzilla.suse.com/842516" }, { "category": "self", "summary": "SUSE Bug 913229", "url": "https://bugzilla.suse.com/913229" }, { "category": "self", "summary": "SUSE Bug 930189", "url": "https://bugzilla.suse.com/930189" }, { "category": "self", "summary": "SUSE Bug 993968", "url": "https://bugzilla.suse.com/993968" }, { "category": "self", "summary": "SUSE CVE CVE-2013-5123 page", "url": "https://www.suse.com/security/cve/CVE-2013-5123/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-8991 page", "url": "https://www.suse.com/security/cve/CVE-2014-8991/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-2296 page", "url": "https://www.suse.com/security/cve/CVE-2015-2296/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20916 page", "url": "https://www.suse.com/security/cve/CVE-2019-20916/" } ], "title": "Feature implementation for python39-pip, python39-setuptools", "tracking": { "current_release_date": "2021-06-23T07:10:31Z", "generator": { "date": "2021-06-23T07:10:31Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-FU-2021:2130-1", "initial_release_date": "2021-06-23T07:10:31Z", "revision_history": [ { "date": "2021-06-23T07:10:31Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "python39-pip-20.2.4-7.5.1.noarch", "product": { "name": "python39-pip-20.2.4-7.5.1.noarch", "product_id": "python39-pip-20.2.4-7.5.1.noarch" } }, { "category": "product_version", "name": "python39-setuptools-44.1.1-7.3.1.noarch", "product": { "name": "python39-setuptools-44.1.1-7.3.1.noarch", "product_id": "python39-setuptools-44.1.1-7.3.1.noarch" } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Module for Basesystem 15 SP3", "product": { "name": "SUSE Linux Enterprise Module for Basesystem 15 SP3", "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp3" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python39-pip-20.2.4-7.5.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP3", "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch" }, "product_reference": "python39-pip-20.2.4-7.5.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "python39-setuptools-44.1.1-7.3.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP3", "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" }, "product_reference": "python39-setuptools-44.1.1-7.3.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3" } ] }, "vulnerabilities": [ { "cve": "CVE-2013-5123", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-5123" } ], "notes": [ { "category": "general", "text": "The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] }, "references": [ { "category": "external", "summary": "CVE-2013-5123", "url": "https://www.suse.com/security/cve/CVE-2013-5123" }, { "category": "external", "summary": "SUSE Bug 864406 for CVE-2013-5123", "url": "https://bugzilla.suse.com/864406" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] } ], "threats": [ { "category": "impact", "date": "2021-06-23T07:10:31Z", "details": "moderate" } ], "title": "CVE-2013-5123" }, { "cve": "CVE-2014-8991", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-8991" } ], "notes": [ { "category": "general", "text": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] }, "references": [ { "category": "external", "summary": "CVE-2014-8991", "url": "https://www.suse.com/security/cve/CVE-2014-8991" }, { "category": "external", "summary": "SUSE Bug 907038 for CVE-2014-8991", "url": "https://bugzilla.suse.com/907038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] } ], "threats": [ { "category": "impact", "date": "2021-06-23T07:10:31Z", "details": "moderate" } ], "title": "CVE-2014-8991" }, { "cve": "CVE-2015-2296", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2015-2296" } ], "notes": [ { "category": "general", "text": "The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] }, "references": [ { "category": "external", "summary": "CVE-2015-2296", "url": "https://www.suse.com/security/cve/CVE-2015-2296" }, { "category": "external", "summary": "SUSE Bug 922448 for CVE-2015-2296", "url": "https://bugzilla.suse.com/922448" }, { "category": "external", "summary": "SUSE Bug 926396 for CVE-2015-2296", "url": "https://bugzilla.suse.com/926396" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] } ], "threats": [ { "category": "impact", "date": "2021-06-23T07:10:31Z", "details": "low" } ], "title": "CVE-2015-2296" }, { "cve": "CVE-2019-20916", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20916" } ], "notes": [ { "category": "general", "text": "The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20916", "url": "https://www.suse.com/security/cve/CVE-2019-20916" }, { "category": "external", "summary": "SUSE Bug 1176262 for CVE-2019-20916", "url": "https://bugzilla.suse.com/1176262" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-pip-20.2.4-7.5.1.noarch", "SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-setuptools-44.1.1-7.3.1.noarch" ] } ], "threats": [ { "category": "impact", "date": "2021-06-23T07:10:31Z", "details": "moderate" } ], "title": "CVE-2019-20916" } ] }
suse-ru-2019:2505-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Recommended update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner", "title": "Title of the patch" }, { "category": "description", "text": "\nThis update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner fixes the following issues:\n\npython-pip was updated to 10.0.1 (fate#324191, bsc#1065275)\n\nEnable python3 build for:\n\n- python-jmespath\n- python-jsonschema\n- python-paramiko\n- python-pexpect\n- python-pip\n- python-ply\n- python-pretend\n- python-process-tests\n- python-pycodestyle\n- python-pyflakes\n- python-pyxdg\n- python-tabulate\n- python-vcversioner\n\n\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-2019-2505,SUSE-OpenStack-Cloud-7-2019-2505,SUSE-SLE-DESKTOP-12-SP4-2019-2505,SUSE-SLE-Module-Public-Cloud-12-2019-2505,SUSE-SLE-SERVER-12-SP4-2019-2505", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-ru-2019_2505-1.json" }, { "category": "self", "summary": "URL for SUSE-RU-2019:2505-1", "url": "https://www.suse.com/support/update/announcement//suse-ru-20192505-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-RU-2019:2505-1", "url": "https://lists.suse.com/pipermail/sle-updates/2019-October/012610.html" }, { "category": "self", "summary": "SUSE Bug 1065275", "url": "https://bugzilla.suse.com/1065275" }, { "category": "self", "summary": "SUSE CVE CVE-2013-5123 page", "url": "https://www.suse.com/security/cve/CVE-2013-5123/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-8991 page", "url": "https://www.suse.com/security/cve/CVE-2014-8991/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-2296 page", "url": "https://www.suse.com/security/cve/CVE-2015-2296/" } ], "title": "Recommended update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner", "tracking": { "current_release_date": "2019-10-01T11:10:29Z", "generator": { "date": "2019-10-01T11:10:29Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-RU-2019:2505-1", "initial_release_date": "2019-10-01T11:10:29Z", "revision_history": [ { "date": "2019-10-01T11:10:29Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "python-jmespath-0.9.2-10.6.1.noarch", "product": { "name": "python-jmespath-0.9.2-10.6.1.noarch", "product_id": "python-jmespath-0.9.2-10.6.1.noarch" } }, { "category": "product_version", "name": "python-jsonschema-2.2.0-3.3.1.noarch", "product": { "name": "python-jsonschema-2.2.0-3.3.1.noarch", "product_id": "python-jsonschema-2.2.0-3.3.1.noarch" } }, { "category": "product_version", "name": "python-paramiko-1.18.5-2.15.1.noarch", "product": { "name": "python-paramiko-1.18.5-2.15.1.noarch", "product_id": "python-paramiko-1.18.5-2.15.1.noarch" } }, { "category": "product_version", "name": "python-pexpect-2.4-4.3.1.noarch", "product": { "name": "python-pexpect-2.4-4.3.1.noarch", "product_id": "python-pexpect-2.4-4.3.1.noarch" } }, { "category": "product_version", "name": "python-pip-10.0.1-11.6.1.noarch", "product": { "name": "python-pip-10.0.1-11.6.1.noarch", "product_id": "python-pip-10.0.1-11.6.1.noarch" } }, { "category": "product_version", "name": "python-ply-3.4-3.3.1.noarch", "product": { "name": "python-ply-3.4-3.3.1.noarch", "product_id": "python-ply-3.4-3.3.1.noarch" } }, { "category": "product_version", "name": "python-ply-doc-3.4-3.3.1.noarch", "product": { "name": "python-ply-doc-3.4-3.3.1.noarch", "product_id": "python-ply-doc-3.4-3.3.1.noarch" } }, { "category": "product_version", "name": "python-pretend-1.0.8-3.3.1.noarch", "product": { "name": "python-pretend-1.0.8-3.3.1.noarch", "product_id": "python-pretend-1.0.8-3.3.1.noarch" } }, { "category": "product_version", "name": "python-process-tests-1.2.2-1.3.1.noarch", "product": { "name": "python-process-tests-1.2.2-1.3.1.noarch", "product_id": "python-process-tests-1.2.2-1.3.1.noarch" } }, { "category": "product_version", "name": "python-pycodestyle-2.3.1-1.3.1.noarch", "product": { "name": "python-pycodestyle-2.3.1-1.3.1.noarch", "product_id": "python-pycodestyle-2.3.1-1.3.1.noarch" } }, { "category": "product_version", "name": "python-pyflakes-1.6.0-1.3.1.noarch", "product": { "name": "python-pyflakes-1.6.0-1.3.1.noarch", "product_id": "python-pyflakes-1.6.0-1.3.1.noarch" } }, { "category": "product_version", "name": "python-pyxdg-0.25-1.3.1.noarch", "product": { "name": "python-pyxdg-0.25-1.3.1.noarch", "product_id": "python-pyxdg-0.25-1.3.1.noarch" } }, { "category": "product_version", "name": "python-tabulate-0.7.7-1.3.1.noarch", "product": { "name": "python-tabulate-0.7.7-1.3.1.noarch", "product_id": "python-tabulate-0.7.7-1.3.1.noarch" } }, { "category": "product_version", "name": "python-vcversioner-2.16.0.0-1.3.1.noarch", "product": { "name": "python-vcversioner-2.16.0.0-1.3.1.noarch", "product_id": "python-vcversioner-2.16.0.0-1.3.1.noarch" } }, { "category": "product_version", "name": "python3-jmespath-0.9.2-10.6.1.noarch", "product": { "name": "python3-jmespath-0.9.2-10.6.1.noarch", "product_id": "python3-jmespath-0.9.2-10.6.1.noarch" } }, { "category": "product_version", "name": "python3-jsonschema-2.2.0-3.3.1.noarch", "product": { "name": "python3-jsonschema-2.2.0-3.3.1.noarch", "product_id": "python3-jsonschema-2.2.0-3.3.1.noarch" } }, { "category": "product_version", "name": "python3-paramiko-1.18.5-2.15.1.noarch", "product": { "name": "python3-paramiko-1.18.5-2.15.1.noarch", "product_id": "python3-paramiko-1.18.5-2.15.1.noarch" } }, { "category": "product_version", "name": "python3-pexpect-2.4-4.3.1.noarch", "product": { "name": "python3-pexpect-2.4-4.3.1.noarch", "product_id": "python3-pexpect-2.4-4.3.1.noarch" } }, { "category": "product_version", "name": "python3-pip-10.0.1-11.6.1.noarch", "product": { "name": "python3-pip-10.0.1-11.6.1.noarch", "product_id": "python3-pip-10.0.1-11.6.1.noarch" } }, { "category": "product_version", "name": "python3-ply-3.4-3.3.1.noarch", "product": { "name": "python3-ply-3.4-3.3.1.noarch", "product_id": "python3-ply-3.4-3.3.1.noarch" } }, { "category": "product_version", "name": "python3-ply-doc-3.4-3.3.1.noarch", "product": { "name": "python3-ply-doc-3.4-3.3.1.noarch", "product_id": "python3-ply-doc-3.4-3.3.1.noarch" } }, { "category": "product_version", "name": "python3-pretend-1.0.8-3.3.1.noarch", "product": { "name": "python3-pretend-1.0.8-3.3.1.noarch", "product_id": "python3-pretend-1.0.8-3.3.1.noarch" } }, { "category": "product_version", "name": "python3-process-tests-1.2.2-1.3.1.noarch", "product": { "name": "python3-process-tests-1.2.2-1.3.1.noarch", "product_id": "python3-process-tests-1.2.2-1.3.1.noarch" } }, { "category": "product_version", "name": "python3-pycodestyle-2.3.1-1.3.1.noarch", "product": { "name": "python3-pycodestyle-2.3.1-1.3.1.noarch", "product_id": "python3-pycodestyle-2.3.1-1.3.1.noarch" } }, { "category": "product_version", "name": "python3-pyflakes-1.6.0-1.3.1.noarch", "product": { "name": "python3-pyflakes-1.6.0-1.3.1.noarch", "product_id": "python3-pyflakes-1.6.0-1.3.1.noarch" } }, { "category": "product_version", "name": "python3-pyxdg-0.25-1.3.1.noarch", "product": { "name": "python3-pyxdg-0.25-1.3.1.noarch", "product_id": "python3-pyxdg-0.25-1.3.1.noarch" } }, { "category": "product_version", "name": "python3-tabulate-0.7.7-1.3.1.noarch", "product": { "name": "python3-tabulate-0.7.7-1.3.1.noarch", "product_id": "python3-tabulate-0.7.7-1.3.1.noarch" } }, { "category": "product_version", "name": "python3-vcversioner-2.16.0.0-1.3.1.noarch", "product": { "name": "python3-vcversioner-2.16.0.0-1.3.1.noarch", "product_id": "python3-vcversioner-2.16.0.0-1.3.1.noarch" } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_name", "name": "SUSE OpenStack Cloud 7", "product": { "name": "SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7", "product_identification_helper": { "cpe": "cpe:/o:suse:suse-openstack-cloud:7" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Desktop 12 SP4", "product": { "name": "SUSE Linux Enterprise Desktop 12 SP4", "product_id": "SUSE Linux Enterprise Desktop 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sled:12:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Module for Public Cloud 12", "product": { "name": "SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-module-public-cloud:12" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP4", "product": { "name": "SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp4" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python-pip-10.0.1-11.6.1.noarch as component of SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7:python-pip-10.0.1-11.6.1.noarch" }, "product_reference": "python-pip-10.0.1-11.6.1.noarch", "relates_to_product_reference": "SUSE OpenStack Cloud 7" }, { "category": "default_component_of", "full_product_name": { "name": "python-ply-3.4-3.3.1.noarch as component of SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7:python-ply-3.4-3.3.1.noarch" }, "product_reference": "python-ply-3.4-3.3.1.noarch", "relates_to_product_reference": "SUSE OpenStack Cloud 7" }, { "category": "default_component_of", "full_product_name": { "name": "python-ply-3.4-3.3.1.noarch as component of SUSE Linux Enterprise Desktop 12 SP4", "product_id": "SUSE Linux Enterprise Desktop 12 SP4:python-ply-3.4-3.3.1.noarch" }, "product_reference": "python-ply-3.4-3.3.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "python-jmespath-0.9.2-10.6.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python-jmespath-0.9.2-10.6.1.noarch" }, "product_reference": "python-jmespath-0.9.2-10.6.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python-jsonschema-2.2.0-3.3.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python-jsonschema-2.2.0-3.3.1.noarch" }, "product_reference": "python-jsonschema-2.2.0-3.3.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python-paramiko-1.18.5-2.15.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.15.1.noarch" }, "product_reference": "python-paramiko-1.18.5-2.15.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python-pip-10.0.1-11.6.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.6.1.noarch" }, "product_reference": "python-pip-10.0.1-11.6.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python-ply-3.4-3.3.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python-ply-3.4-3.3.1.noarch" }, "product_reference": "python-ply-3.4-3.3.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python3-jmespath-0.9.2-10.6.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python3-jmespath-0.9.2-10.6.1.noarch" }, "product_reference": "python3-jmespath-0.9.2-10.6.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python3-jsonschema-2.2.0-3.3.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python3-jsonschema-2.2.0-3.3.1.noarch" }, "product_reference": "python3-jsonschema-2.2.0-3.3.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python3-paramiko-1.18.5-2.15.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python3-paramiko-1.18.5-2.15.1.noarch" }, "product_reference": "python3-paramiko-1.18.5-2.15.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python3-pip-10.0.1-11.6.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.6.1.noarch" }, "product_reference": "python3-pip-10.0.1-11.6.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python3-ply-3.4-3.3.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12", "product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python3-ply-3.4-3.3.1.noarch" }, "product_reference": "python3-ply-3.4-3.3.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12" }, { "category": "default_component_of", "full_product_name": { "name": "python-ply-3.4-3.3.1.noarch as component of SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4:python-ply-3.4-3.3.1.noarch" }, "product_reference": "python-ply-3.4-3.3.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "python-ply-3.4-3.3.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-ply-3.4-3.3.1.noarch" }, "product_reference": "python-ply-3.4-3.3.1.noarch", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" } ] }, "vulnerabilities": [ { "cve": "CVE-2013-5123", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-5123" } ], "notes": [ { "category": "general", "text": "The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE OpenStack Cloud 7:python-pip-10.0.1-11.6.1.noarch", "SUSE OpenStack Cloud 7:python-ply-3.4-3.3.1.noarch" ] }, "references": [ { "category": "external", "summary": "CVE-2013-5123", "url": "https://www.suse.com/security/cve/CVE-2013-5123" }, { "category": "external", "summary": "SUSE Bug 864406 for CVE-2013-5123", "url": "https://bugzilla.suse.com/864406" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE OpenStack Cloud 7:python-pip-10.0.1-11.6.1.noarch", "SUSE OpenStack Cloud 7:python-ply-3.4-3.3.1.noarch" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE OpenStack Cloud 7:python-pip-10.0.1-11.6.1.noarch", "SUSE OpenStack Cloud 7:python-ply-3.4-3.3.1.noarch" ] } ], "threats": [ { "category": "impact", "date": "2019-10-01T11:10:29Z", "details": "moderate" } ], "title": "CVE-2013-5123" }, { "cve": "CVE-2014-8991", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-8991" } ], "notes": [ { "category": "general", "text": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE OpenStack Cloud 7:python-pip-10.0.1-11.6.1.noarch", "SUSE OpenStack Cloud 7:python-ply-3.4-3.3.1.noarch" ] }, "references": [ { "category": "external", "summary": "CVE-2014-8991", "url": "https://www.suse.com/security/cve/CVE-2014-8991" }, { "category": "external", "summary": "SUSE Bug 907038 for CVE-2014-8991", "url": "https://bugzilla.suse.com/907038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE OpenStack Cloud 7:python-pip-10.0.1-11.6.1.noarch", "SUSE OpenStack Cloud 7:python-ply-3.4-3.3.1.noarch" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE OpenStack Cloud 7:python-pip-10.0.1-11.6.1.noarch", "SUSE OpenStack Cloud 7:python-ply-3.4-3.3.1.noarch" ] } ], "threats": [ { "category": "impact", "date": "2019-10-01T11:10:29Z", "details": "moderate" } ], "title": "CVE-2014-8991" }, { "cve": "CVE-2015-2296", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2015-2296" } ], "notes": [ { "category": "general", "text": "The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE OpenStack Cloud 7:python-pip-10.0.1-11.6.1.noarch", "SUSE OpenStack Cloud 7:python-ply-3.4-3.3.1.noarch" ] }, "references": [ { "category": "external", "summary": "CVE-2015-2296", "url": "https://www.suse.com/security/cve/CVE-2015-2296" }, { "category": "external", "summary": "SUSE Bug 922448 for CVE-2015-2296", "url": "https://bugzilla.suse.com/922448" }, { "category": "external", "summary": "SUSE Bug 926396 for CVE-2015-2296", "url": "https://bugzilla.suse.com/926396" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jmespath-0.9.2-10.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-jsonschema-2.2.0-3.3.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-paramiko-1.18.5-2.15.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.6.1.noarch", "SUSE Linux Enterprise Module for Public Cloud 12:python3-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:python-ply-3.4-3.3.1.noarch", "SUSE OpenStack Cloud 7:python-pip-10.0.1-11.6.1.noarch", "SUSE OpenStack Cloud 7:python-ply-3.4-3.3.1.noarch" ] } ], "threats": [ { "category": "impact", "date": "2019-10-01T11:10:29Z", "details": "low" } ], "title": "CVE-2015-2296" } ] }
msrc_cve-2014-8991
Vulnerability from csaf_microsoft
Notes
{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Public", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.", "title": "Disclaimer" } ], "publisher": { "category": "vendor", "contact_details": "secure@microsoft.com", "name": "Microsoft Security Response Center", "namespace": "https://msrc.microsoft.com" }, "references": [ { "category": "self", "summary": "CVE-2014-8991 pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user. - VEX", "url": "https://msrc.microsoft.com/csaf/vex/2014/msrc_cve-2014-8991.json" }, { "category": "external", "summary": "Microsoft Support Lifecycle", "url": "https://support.microsoft.com/lifecycle" }, { "category": "external", "summary": "Common Vulnerability Scoring System", "url": "https://www.first.org/cvss" } ], "title": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "tracking": { "current_release_date": "2025-09-03T21:14:33.000Z", "generator": { "date": "2025-10-19T16:56:47.637Z", "engine": { "name": "MSRC Generator", "version": "1.0" } }, "id": "msrc_CVE-2014-8991", "initial_release_date": "2014-11-02T00:00:00.000Z", "revision_history": [ { "date": "2025-09-03T21:14:33.000Z", "legacy_version": "1", "number": "1", "summary": "Information published." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "3.0", "product": { "name": "Azure Linux 3.0", "product_id": "17084" } } ], "category": "product_name", "name": "Azure Linux" }, { "category": "product_name", "name": "azl3 python-pip 24.2-2", "product": { "name": "azl3 python-pip 24.2-2", "product_id": "1" } } ], "category": "vendor", "name": "Microsoft" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "azl3 python-pip 24.2-2 as a component of Azure Linux 3.0", "product_id": "17084-1" }, "product_reference": "1", "relates_to_product_reference": "17084" } ] }, "vulnerabilities": [ { "cve": "CVE-2014-8991", "flags": [ { "label": "component_not_present", "product_ids": [ "17084-1" ] } ], "notes": [ { "category": "general", "text": "mitre", "title": "Assigning CNA" } ], "product_status": { "known_not_affected": [ "17084-1" ] }, "references": [ { "category": "self", "summary": "CVE-2014-8991 pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user. - VEX", "url": "https://msrc.microsoft.com/csaf/vex/2014/msrc_cve-2014-8991.json" } ], "title": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user." } ] }
ghsa-53mr-44pp-crf4
Vulnerability from github
5.5 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-*
file for another user.
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "pip" }, "ranges": [ { "events": [ { "introduced": "1.3" }, { "fixed": "6.0" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2014-8991" ], "database_specific": { "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2023-10-19T17:39:17Z", "nvd_published_at": "2014-11-24T15:59:00Z", "severity": "MODERATE" }, "details": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a `/tmp/pip-build-*` file for another user.", "id": "GHSA-53mr-44pp-crf4", "modified": "2024-10-09T21:26:58Z", "published": "2022-05-13T01:11:25Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8991" }, { "type": "WEB", "url": "https://github.com/pypa/pip/pull/2122" }, { "type": "WEB", "url": "https://github.com/pypa/pip/commit/043fe9f5700315d97f83609c1f59deece8f1b901" }, { "type": "WEB", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847" }, { "type": "WEB", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2014-11.yaml" }, { "type": "PACKAGE", "url": "https://github.com/pypa/pip" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6" }, { "type": "WEB", "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "type": "CVSS_V4" } ], "summary": "pip lack of randomness in build directory" }
CERTFR-2015-AVI-308
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans Oracle Solaris. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Contournement provisoire
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneTitle | Publication Time | Tags | |||
---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "Oracle Solaris versions 11.2 et ant\u00e9rieures", "product": { "name": "N/A", "vendor": { "name": "Oracle", "scada": false } } }, { "description": "Oracle Solaris versions 10 et ant\u00e9rieures", "product": { "name": "N/A", "vendor": { "name": "Oracle", "scada": false } } } ], "affected_systems_content": null, "content": "## Contournement provisoire\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2014-8768", "url": "https://www.cve.org/CVERecord?id=CVE-2014-8768" }, { "name": "CVE-2014-3566", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3566" }, { "name": "CVE-2015-1791", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1791" }, { "name": "CVE-2014-8991", "url": "https://www.cve.org/CVERecord?id=CVE-2014-8991" }, { "name": "CVE-2014-9652", "url": "https://www.cve.org/CVERecord?id=CVE-2014-9652" }, { "name": "CVE-2015-0261", "url": "https://www.cve.org/CVERecord?id=CVE-2015-0261" }, { "name": "CVE-2014-9705", "url": "https://www.cve.org/CVERecord?id=CVE-2014-9705" }, { "name": "CVE-2015-0255", "url": "https://www.cve.org/CVERecord?id=CVE-2015-0255" }, { "name": "CVE-2014-6511", "url": "https://www.cve.org/CVERecord?id=CVE-2014-6511" }, { "name": "CVE-2015-2787", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2787" }, { "name": "CVE-2015-4000", "url": "https://www.cve.org/CVERecord?id=CVE-2015-4000" }, { "name": "CVE-2015-1789", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1789" }, { "name": "CVE-2014-9425", "url": "https://www.cve.org/CVERecord?id=CVE-2014-9425" }, { "name": "CVE-2014-9462", "url": "https://www.cve.org/CVERecord?id=CVE-2014-9462" }, { "name": "CVE-2014-9653", "url": "https://www.cve.org/CVERecord?id=CVE-2014-9653" }, { "name": "CVE-2015-0273", "url": "https://www.cve.org/CVERecord?id=CVE-2015-0273" }, { "name": "CVE-2015-1788", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1788" }, { "name": "CVE-2015-1792", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1792" }, { "name": "CVE-2014-3710", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3710" }, { "name": "CVE-2015-0231", "url": "https://www.cve.org/CVERecord?id=CVE-2015-0231" }, { "name": "CVE-2015-3988", "url": "https://www.cve.org/CVERecord?id=CVE-2015-3988" }, { "name": "CVE-2015-1855", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1855" }, { "name": "CVE-2015-2331", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2331" }, { "name": "CVE-2015-1351", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1351" }, { "name": "CVE-2015-0232", "url": "https://www.cve.org/CVERecord?id=CVE-2015-0232" }, { "name": "CVE-2015-3294", "url": "https://www.cve.org/CVERecord?id=CVE-2015-3294" }, { "name": "CVE-2015-2348", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2348" }, { "name": "CVE-2015-1790", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1790" } ], "initial_release_date": "2015-07-15T00:00:00", "last_revision_date": "2015-07-15T00:00:00", "links": [], "reference": "CERTFR-2015-AVI-308", "revisions": [ { "description": "version initiale.", "revision_date": "2015-07-15T00:00:00.000000" } ], "risks": [ { "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eOracle Solaris\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans Oracle Solaris", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Oracle du 14 juillet 2015", "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" } ] }
CERTFR-2022-AVI-267
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Juniper Networks Junos Space. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneVendor | Product | Description | ||
---|---|---|---|---|
Juniper Networks | Junos Space | Juniper Networks Junos Space versions antérieures à 21.1R1 |
Title | Publication Time | Tags | |||
---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "Juniper Networks Junos Space versions ant\u00e9rieures \u00e0 21.1R1", "product": { "name": "Junos Space", "vendor": { "name": "Juniper Networks", "scada": false } } } ], "affected_systems_content": null, "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2017-13078", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13078" }, { "name": "CVE-2017-13077", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13077" }, { "name": "CVE-2017-13080", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13080" }, { "name": "CVE-2017-13082", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13082" }, { "name": "CVE-2017-13088", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13088" }, { "name": "CVE-2017-13086", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13086" }, { "name": "CVE-2017-13087", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13087" }, { "name": "CVE-2017-5715", "url": "https://www.cve.org/CVERecord?id=CVE-2017-5715" }, { "name": "CVE-2018-3639", "url": "https://www.cve.org/CVERecord?id=CVE-2018-3639" }, { "name": "CVE-2007-1351", "url": "https://www.cve.org/CVERecord?id=CVE-2007-1351" }, { "name": "CVE-2007-1352", "url": "https://www.cve.org/CVERecord?id=CVE-2007-1352" }, { "name": "CVE-2007-6284", "url": "https://www.cve.org/CVERecord?id=CVE-2007-6284" }, { "name": "CVE-2008-2935", "url": "https://www.cve.org/CVERecord?id=CVE-2008-2935" }, { "name": "CVE-2008-3281", "url": "https://www.cve.org/CVERecord?id=CVE-2008-3281" }, { "name": "CVE-2008-3529", "url": "https://www.cve.org/CVERecord?id=CVE-2008-3529" }, { "name": "CVE-2008-4226", "url": "https://www.cve.org/CVERecord?id=CVE-2008-4226" }, { "name": "CVE-2008-4225", "url": "https://www.cve.org/CVERecord?id=CVE-2008-4225" }, { "name": "CVE-2009-2414", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2414" }, { "name": "CVE-2009-2416", "url": "https://www.cve.org/CVERecord?id=CVE-2009-2416" }, { "name": "CVE-2008-5161", "url": "https://www.cve.org/CVERecord?id=CVE-2008-5161" }, { "name": "CVE-2010-4008", "url": "https://www.cve.org/CVERecord?id=CVE-2010-4008" }, { "name": "CVE-2011-0411", "url": "https://www.cve.org/CVERecord?id=CVE-2011-0411" }, { "name": "CVE-2011-1720", "url": "https://www.cve.org/CVERecord?id=CVE-2011-1720" }, { "name": "CVE-2011-0216", "url": "https://www.cve.org/CVERecord?id=CVE-2011-0216" }, { "name": "CVE-2011-2834", "url": "https://www.cve.org/CVERecord?id=CVE-2011-2834" }, { "name": "CVE-2011-2895", "url": "https://www.cve.org/CVERecord?id=CVE-2011-2895" }, { "name": "CVE-2011-3905", "url": "https://www.cve.org/CVERecord?id=CVE-2011-3905" }, { "name": "CVE-2011-3919", "url": "https://www.cve.org/CVERecord?id=CVE-2011-3919" }, { "name": "CVE-2012-0841", "url": "https://www.cve.org/CVERecord?id=CVE-2012-0841" }, { "name": "CVE-2011-1944", "url": "https://www.cve.org/CVERecord?id=CVE-2011-1944" }, { "name": "CVE-2012-2807", "url": "https://www.cve.org/CVERecord?id=CVE-2012-2807" }, { "name": "CVE-2012-2870", "url": "https://www.cve.org/CVERecord?id=CVE-2012-2870" }, { "name": "CVE-2012-5134", "url": "https://www.cve.org/CVERecord?id=CVE-2012-5134" }, { "name": "CVE-2011-3102", "url": "https://www.cve.org/CVERecord?id=CVE-2011-3102" }, { "name": "CVE-2013-2877", "url": "https://www.cve.org/CVERecord?id=CVE-2013-2877" }, { "name": "CVE-2013-0338", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0338" }, { "name": "CVE-2012-6139", "url": "https://www.cve.org/CVERecord?id=CVE-2012-6139" }, { "name": "CVE-2013-2566", "url": "https://www.cve.org/CVERecord?id=CVE-2013-2566" }, { "name": "CVE-2013-6462", "url": "https://www.cve.org/CVERecord?id=CVE-2013-6462" }, { "name": "CVE-2014-0211", "url": "https://www.cve.org/CVERecord?id=CVE-2014-0211" }, { "name": "CVE-2014-3660", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3660" }, { "name": "CVE-2015-1803", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1803" }, { "name": "CVE-2015-1804", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1804" }, { "name": "CVE-2015-1802", "url": "https://www.cve.org/CVERecord?id=CVE-2015-1802" }, { "name": "CVE-2015-2716", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2716" }, { "name": "CVE-2015-5352", "url": "https://www.cve.org/CVERecord?id=CVE-2015-5352" }, { "name": "CVE-2015-2808", "url": "https://www.cve.org/CVERecord?id=CVE-2015-2808" }, { "name": "CVE-2014-8991", "url": "https://www.cve.org/CVERecord?id=CVE-2014-8991" }, { "name": "CVE-2014-7185", "url": "https://www.cve.org/CVERecord?id=CVE-2014-7185" }, { "name": "CVE-2014-9365", "url": "https://www.cve.org/CVERecord?id=CVE-2014-9365" }, { "name": "CVE-2015-6838", "url": "https://www.cve.org/CVERecord?id=CVE-2015-6838" }, { "name": "CVE-2015-6837", "url": "https://www.cve.org/CVERecord?id=CVE-2015-6837" }, { "name": "CVE-2015-7995", "url": "https://www.cve.org/CVERecord?id=CVE-2015-7995" }, { "name": "CVE-2015-8035", "url": "https://www.cve.org/CVERecord?id=CVE-2015-8035" }, { "name": "CVE-2015-7499", "url": "https://www.cve.org/CVERecord?id=CVE-2015-7499" }, { "name": "CVE-2015-8242", "url": "https://www.cve.org/CVERecord?id=CVE-2015-8242" }, { "name": "CVE-2015-7500", "url": "https://www.cve.org/CVERecord?id=CVE-2015-7500" }, { "name": "CVE-2016-1762", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1762" }, { "name": "CVE-2015-5312", "url": "https://www.cve.org/CVERecord?id=CVE-2015-5312" }, { "name": "CVE-2016-1839", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1839" }, { "name": "CVE-2016-1833", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1833" }, { "name": "CVE-2016-1837", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1837" }, { "name": "CVE-2016-1834", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1834" }, { "name": "CVE-2016-1840", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1840" }, { "name": "CVE-2016-1836", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1836" }, { "name": "CVE-2016-1838", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1838" }, { "name": "CVE-2016-1684", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1684" }, { "name": "CVE-2016-1683", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1683" }, { "name": "CVE-2016-4448", "url": "https://www.cve.org/CVERecord?id=CVE-2016-4448" }, { "name": "CVE-2016-4447", "url": "https://www.cve.org/CVERecord?id=CVE-2016-4447" }, { "name": "CVE-2016-4449", "url": "https://www.cve.org/CVERecord?id=CVE-2016-4449" }, { "name": "CVE-2016-5131", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5131" }, { "name": "CVE-2015-0975", "url": "https://www.cve.org/CVERecord?id=CVE-2015-0975" }, { "name": "CVE-2016-4658", "url": "https://www.cve.org/CVERecord?id=CVE-2016-4658" }, { "name": "CVE-2016-2183", "url": "https://www.cve.org/CVERecord?id=CVE-2016-2183" }, { "name": "CVE-2016-3627", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3627" }, { "name": "CVE-2016-3115", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3115" }, { "name": "CVE-2016-5636", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5636" }, { "name": "CVE-2017-7375", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7375" }, { "name": "CVE-2017-7376", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7376" }, { "name": "CVE-2017-7773", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7773" }, { "name": "CVE-2017-7772", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7772" }, { "name": "CVE-2017-7778", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7778" }, { "name": "CVE-2017-7771", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7771" }, { "name": "CVE-2017-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7774" }, { "name": "CVE-2017-7776", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7776" }, { "name": "CVE-2017-7777", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7777" }, { "name": "CVE-2017-7775", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7775" }, { "name": "CVE-2017-6463", "url": "https://www.cve.org/CVERecord?id=CVE-2017-6463" }, { "name": "CVE-2017-6462", "url": "https://www.cve.org/CVERecord?id=CVE-2017-6462" }, { "name": "CVE-2017-6464", "url": "https://www.cve.org/CVERecord?id=CVE-2017-6464" }, { "name": "CVE-2017-14492", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14492" }, { "name": "CVE-2017-14496", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14496" }, { "name": "CVE-2017-14491", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14491" }, { "name": "CVE-2017-14493", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14493" }, { "name": "CVE-2017-14494", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14494" }, { "name": "CVE-2017-14495", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14495" }, { "name": "CVE-2017-5130", "url": "https://www.cve.org/CVERecord?id=CVE-2017-5130" }, { "name": "CVE-2017-3736", "url": "https://www.cve.org/CVERecord?id=CVE-2017-3736" }, { "name": "CVE-2017-3735", "url": "https://www.cve.org/CVERecord?id=CVE-2017-3735" }, { "name": "CVE-2017-15412", "url": "https://www.cve.org/CVERecord?id=CVE-2017-15412" }, { "name": "CVE-2017-3738", "url": "https://www.cve.org/CVERecord?id=CVE-2017-3738" }, { "name": "CVE-2017-3737", "url": "https://www.cve.org/CVERecord?id=CVE-2017-3737" }, { "name": "CVE-2017-17807", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17807" }, { "name": "CVE-2018-0739", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0739" }, { "name": "CVE-2017-16931", "url": "https://www.cve.org/CVERecord?id=CVE-2017-16931" }, { "name": "CVE-2018-11214", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11214" }, { "name": "CVE-2015-9019", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9019" }, { "name": "CVE-2017-18258", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18258" }, { "name": "CVE-2017-16932", "url": "https://www.cve.org/CVERecord?id=CVE-2017-16932" }, { "name": "CVE-2016-9318", "url": "https://www.cve.org/CVERecord?id=CVE-2016-9318" }, { "name": "CVE-2018-1000120", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000120" }, { "name": "CVE-2018-1000007", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000007" }, { "name": "CVE-2018-1000121", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000121" }, { "name": "CVE-2018-1000122", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000122" }, { "name": "CVE-2018-0732", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0732" }, { "name": "CVE-2018-6914", "url": "https://www.cve.org/CVERecord?id=CVE-2018-6914" }, { "name": "CVE-2017-0898", "url": "https://www.cve.org/CVERecord?id=CVE-2017-0898" }, { "name": "CVE-2018-8778", "url": "https://www.cve.org/CVERecord?id=CVE-2018-8778" }, { "name": "CVE-2017-14033", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14033" }, { "name": "CVE-2018-8780", "url": "https://www.cve.org/CVERecord?id=CVE-2018-8780" }, { "name": "CVE-2017-17742", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17742" }, { "name": "CVE-2017-10784", "url": "https://www.cve.org/CVERecord?id=CVE-2017-10784" }, { "name": "CVE-2017-17405", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17405" }, { "name": "CVE-2018-8779", "url": "https://www.cve.org/CVERecord?id=CVE-2018-8779" }, { "name": "CVE-2017-14064", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14064" }, { "name": "CVE-2018-8777", "url": "https://www.cve.org/CVERecord?id=CVE-2018-8777" }, { "name": "CVE-2018-16395", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16395" }, { "name": "CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "name": "CVE-2018-16396", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16396" }, { "name": "CVE-2018-0495", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0495" }, { "name": "CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "name": "CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "name": "CVE-2018-1126", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1126" }, { "name": "CVE-2018-7858", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7858" }, { "name": "CVE-2018-1124", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1124" }, { "name": "CVE-2018-10897", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10897" }, { "name": "CVE-2018-1064", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1064" }, { "name": "CVE-2018-5683", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5683" }, { "name": "CVE-2017-13672", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13672" }, { "name": "CVE-2018-11212", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11212" }, { "name": "CVE-2017-18267", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18267" }, { "name": "CVE-2018-13988", "url": "https://www.cve.org/CVERecord?id=CVE-2018-13988" }, { "name": "CVE-2018-20169", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20169" }, { "name": "CVE-2018-19985", "url": "https://www.cve.org/CVERecord?id=CVE-2018-19985" }, { "name": "CVE-2019-1559", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1559" }, { "name": "CVE-2019-6133", "url": "https://www.cve.org/CVERecord?id=CVE-2019-6133" }, { "name": "CVE-2018-18311", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18311" }, { "name": "CVE-2018-12127", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12127" }, { "name": "CVE-2018-12130", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12130" }, { "name": "CVE-2019-11091", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11091" }, { "name": "CVE-2018-12126", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12126" }, { "name": "CVE-2019-9503", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9503" }, { "name": "CVE-2019-10132", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10132" }, { "name": "CVE-2019-11190", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11190" }, { "name": "CVE-2019-11884", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11884" }, { "name": "CVE-2019-11487", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11487" }, { "name": "CVE-2019-12382", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12382" }, { "name": "CVE-2018-7191", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7191" }, { "name": "CVE-2019-5953", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5953" }, { "name": "CVE-2019-12614", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12614" }, { "name": "CVE-2019-11729", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11729" }, { "name": "CVE-2019-11727", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11727" }, { "name": "CVE-2019-11719", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11719" }, { "name": "CVE-2018-1060", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1060" }, { "name": "CVE-2018-12327", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12327" }, { "name": "CVE-2018-1061", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1061" }, { "name": "CVE-2019-10639", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10639" }, { "name": "CVE-2019-10638", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10638" }, { "name": "CVE-2018-20836", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20836" }, { "name": "CVE-2019-13233", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13233" }, { "name": "CVE-2019-14283", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14283" }, { "name": "CVE-2019-13648", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13648" }, { "name": "CVE-2019-10207", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10207" }, { "name": "CVE-2015-9289", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9289" }, { "name": "CVE-2019-14816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14816" }, { "name": "CVE-2019-15239", "url": "https://www.cve.org/CVERecord?id=CVE-2019-15239" }, { "name": "CVE-2019-15917", "url": "https://www.cve.org/CVERecord?id=CVE-2019-15917" }, { "name": "CVE-2017-18551", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18551" }, { "name": "CVE-2019-15217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-15217" }, { "name": "CVE-2019-14821", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14821" }, { "name": "CVE-2019-11068", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11068" }, { "name": "CVE-2018-18066", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18066" }, { "name": "CVE-2019-15903", "url": "https://www.cve.org/CVERecord?id=CVE-2019-15903" }, { "name": "CVE-2019-17666", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17666" }, { "name": "CVE-2019-17133", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17133" }, { "name": "CVE-2018-12207", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12207" }, { "name": "CVE-2019-11135", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11135" }, { "name": "CVE-2019-0154", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0154" }, { "name": "CVE-2019-17055", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17055" }, { "name": "CVE-2019-17053", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17053" }, { "name": "CVE-2019-16746", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16746" }, { "name": "CVE-2019-0155", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0155" }, { "name": "CVE-2019-16233", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16233" }, { "name": "CVE-2019-15807", "url": "https://www.cve.org/CVERecord?id=CVE-2019-15807" }, { "name": "CVE-2019-16231", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16231" }, { "name": "CVE-2019-11756", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11756" }, { "name": "CVE-2019-11745", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11745" }, { "name": "CVE-2019-19058", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19058" }, { "name": "CVE-2019-14895", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14895" }, { "name": "CVE-2019-19046", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19046" }, { "name": "CVE-2019-15916", "url": "https://www.cve.org/CVERecord?id=CVE-2019-15916" }, { "name": "CVE-2019-18660", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18660" }, { "name": "CVE-2019-19063", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19063" }, { "name": "CVE-2019-19062", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19062" }, { "name": "CVE-2018-14526", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14526" }, { "name": "CVE-2019-13734", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13734" }, { "name": "CVE-2019-19530", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19530" }, { "name": "CVE-2019-19534", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19534" }, { "name": "CVE-2019-19524", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19524" }, { "name": "CVE-2019-14901", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14901" }, { "name": "CVE-2019-19537", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19537" }, { "name": "CVE-2019-19523", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19523" }, { "name": "CVE-2019-19338", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19338" }, { "name": "CVE-2019-19332", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19332" }, { "name": "CVE-2019-19527", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19527" }, { "name": "CVE-2019-18808", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18808" }, { "name": "CVE-2019-19767", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19767" }, { "name": "CVE-2019-19807", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19807" }, { "name": "CVE-2019-19055", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19055" }, { "name": "CVE-2019-17023", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17023" }, { "name": "CVE-2019-9824", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9824" }, { "name": "CVE-2019-9636", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9636" }, { "name": "CVE-2019-12749", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12749" }, { "name": "CVE-2019-19447", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19447" }, { "name": "CVE-2019-20095", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20095" }, { "name": "CVE-2019-20054", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20054" }, { "name": "CVE-2019-18634", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18634" }, { "name": "CVE-2019-14898", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14898" }, { "name": "CVE-2019-16994", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16994" }, { "name": "CVE-2019-18282", "url": "https://www.cve.org/CVERecord?id=CVE-2019-18282" }, { "name": "CVE-2020-2732", "url": "https://www.cve.org/CVERecord?id=CVE-2020-2732" }, { "name": "CVE-2019-19059", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19059" }, { "name": "CVE-2019-3901", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3901" }, { "name": "CVE-2020-9383", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9383" }, { "name": "CVE-2020-8647", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8647" }, { "name": "CVE-2020-8649", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8649" }, { "name": "CVE-2020-1749", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1749" }, { "name": "CVE-2019-9458", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9458" }, { "name": "CVE-2020-10942", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10942" }, { "name": "CVE-2019-9454", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9454" }, { "name": "CVE-2020-11565", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11565" }, { "name": "CVE-2020-10690", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10690" }, { "name": "CVE-2020-10751", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10751" }, { "name": "CVE-2020-12826", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12826" }, { "name": "CVE-2020-12654", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12654" }, { "name": "CVE-2020-10732", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10732" }, { "name": "CVE-2019-20636", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20636" }, { "name": "CVE-2019-20811", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20811" }, { "name": "CVE-2020-12653", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12653" }, { "name": "CVE-2020-10757", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10757" }, { "name": "CVE-2020-12770", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12770" }, { "name": "CVE-2020-12888", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12888" }, { "name": "CVE-2020-12402", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12402" }, { "name": "CVE-2018-16881", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16881" }, { "name": "CVE-2018-19519", "url": "https://www.cve.org/CVERecord?id=CVE-2018-19519" }, { "name": "CVE-2020-10713", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10713" }, { "name": "CVE-2020-14311", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14311" }, { "name": "CVE-2020-14309", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14309" }, { "name": "CVE-2020-15706", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15706" }, { "name": "CVE-2020-14308", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14308" }, { "name": "CVE-2020-14310", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14310" }, { "name": "CVE-2020-15705", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15705" }, { "name": "CVE-2020-15707", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15707" }, { "name": "CVE-2020-14331", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14331" }, { "name": "CVE-2020-10769", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10769" }, { "name": "CVE-2020-14364", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14364" }, { "name": "CVE-2020-12400", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12400" }, { "name": "CVE-2020-12401", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12401" }, { "name": "CVE-2020-6829", "url": "https://www.cve.org/CVERecord?id=CVE-2020-6829" }, { "name": "CVE-2020-14314", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14314" }, { "name": "CVE-2020-24394", "url": "https://www.cve.org/CVERecord?id=CVE-2020-24394" }, { "name": "CVE-2020-25212", "url": "https://www.cve.org/CVERecord?id=CVE-2020-25212" }, { "name": "CVE-2020-14305", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14305" }, { "name": "CVE-2020-10742", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10742" }, { "name": "CVE-2020-14385", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14385" }, { "name": "CVE-2020-25643", "url": "https://www.cve.org/CVERecord?id=CVE-2020-25643" }, { "name": "CVE-2020-15999", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15999" }, { "name": "CVE-2018-20843", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20843" }, { "name": "CVE-2018-5729", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5729" }, { "name": "CVE-2018-5730", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5730" }, { "name": "CVE-2020-13817", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13817" }, { "name": "CVE-2020-11868", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11868" }, { "name": "CVE-2021-3156", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3156" }, { "name": "CVE-2019-17006", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17006" }, { "name": "CVE-2019-13232", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13232" }, { "name": "CVE-2020-10531", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10531" }, { "name": "CVE-2019-8696", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8696" }, { "name": "CVE-2019-20907", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20907" }, { "name": "CVE-2019-8675", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8675" }, { "name": "CVE-2017-12652", "url": "https://www.cve.org/CVERecord?id=CVE-2017-12652" }, { "name": "CVE-2019-12450", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12450" }, { "name": "CVE-2020-12825", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12825" }, { "name": "CVE-2020-12243", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12243" }, { "name": "CVE-2019-14866", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14866" }, { "name": "CVE-2020-1983", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1983" }, { "name": "CVE-2019-5188", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5188" }, { "name": "CVE-2019-5094", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5094" }, { "name": "CVE-2020-10754", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10754" }, { "name": "CVE-2020-12049", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12049" }, { "name": "CVE-2019-14822", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14822" }, { "name": "CVE-2020-14363", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14363" }, { "name": "CVE-2019-9924", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9924" }, { "name": "CVE-2018-18751", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18751" }, { "name": "CVE-2019-9948", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9948" }, { "name": "CVE-2019-20386", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20386" }, { "name": "CVE-2017-13722", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13722" }, { "name": "CVE-2014-0210", "url": "https://www.cve.org/CVERecord?id=CVE-2014-0210" }, { "name": "CVE-2018-16403", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16403" }, { "name": "CVE-2018-15746", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15746" }, { "name": "CVE-2014-6272", "url": "https://www.cve.org/CVERecord?id=CVE-2014-6272" }, { "name": "CVE-2019-7638", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7638" }, { "name": "CVE-2015-8241", "url": "https://www.cve.org/CVERecord?id=CVE-2015-8241" }, { "name": "CVE-2019-10155", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10155" }, { "name": "CVE-2018-11813", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11813" }, { "name": "CVE-2018-18310", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18310" }, { "name": "CVE-2018-1084", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1084" }, { "name": "CVE-2020-12662", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12662" }, { "name": "CVE-2012-4423", "url": "https://www.cve.org/CVERecord?id=CVE-2012-4423" }, { "name": "CVE-2017-0902", "url": "https://www.cve.org/CVERecord?id=CVE-2017-0902" }, { "name": "CVE-2018-8945", "url": "https://www.cve.org/CVERecord?id=CVE-2018-8945" }, { "name": "CVE-2017-0899", "url": "https://www.cve.org/CVERecord?id=CVE-2017-0899" }, { "name": "CVE-2010-2239", "url": "https://www.cve.org/CVERecord?id=CVE-2010-2239" }, { "name": "CVE-2010-2242", "url": "https://www.cve.org/CVERecord?id=CVE-2010-2242" }, { "name": "CVE-2017-14167", "url": "https://www.cve.org/CVERecord?id=CVE-2017-14167" }, { "name": "CVE-2015-0225", "url": "https://www.cve.org/CVERecord?id=CVE-2015-0225" }, { "name": "CVE-2019-11324", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11324" }, { "name": "CVE-2013-6458", "url": "https://www.cve.org/CVERecord?id=CVE-2013-6458" }, { "name": "CVE-2018-1000075", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000075" }, { "name": "CVE-2018-15857", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15857" }, { "name": "CVE-2018-16062", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16062" }, { "name": "CVE-2018-10534", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10534" }, { "name": "CVE-2014-0179", "url": "https://www.cve.org/CVERecord?id=CVE-2014-0179" }, { "name": "CVE-2018-18384", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18384" }, { "name": "CVE-2013-1766", "url": "https://www.cve.org/CVERecord?id=CVE-2013-1766" }, { "name": "CVE-2016-6580", "url": "https://www.cve.org/CVERecord?id=CVE-2016-6580" }, { "name": "CVE-2018-12697", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12697" }, { "name": "CVE-2018-1000301", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000301" }, { "name": "CVE-2019-11236", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11236" }, { "name": "CVE-2019-12155", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12155" }, { "name": "CVE-2017-0900", "url": "https://www.cve.org/CVERecord?id=CVE-2017-0900" }, { "name": "CVE-2014-3598", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3598" }, { "name": "CVE-2017-1000050", "url": "https://www.cve.org/CVERecord?id=CVE-2017-1000050" }, { "name": "CVE-2018-10535", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10535" }, { "name": "CVE-2019-3820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3820" }, { "name": "CVE-2018-16402", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16402" }, { "name": "CVE-2018-1116", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1116" }, { "name": "CVE-2018-15853", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15853" }, { "name": "CVE-2019-14378", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14378" }, { "name": "CVE-2016-1494", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1494" }, { "name": "CVE-2019-12312", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12312" }, { "name": "CVE-2013-0339", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0339" }, { "name": "CVE-2019-16935", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16935" }, { "name": "CVE-2015-6525", "url": "https://www.cve.org/CVERecord?id=CVE-2015-6525" }, { "name": "CVE-2016-6581", "url": "https://www.cve.org/CVERecord?id=CVE-2016-6581" }, { "name": "CVE-2013-4520", "url": "https://www.cve.org/CVERecord?id=CVE-2013-4520" }, { "name": "CVE-2014-3633", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3633" }, { "name": "CVE-2014-3004", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3004" }, { "name": "CVE-2015-9381", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9381" }, { "name": "CVE-2016-5361", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5361" }, { "name": "CVE-2018-14598", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14598" }, { "name": "CVE-2014-1447", "url": "https://www.cve.org/CVERecord?id=CVE-2014-1447" }, { "name": "CVE-2018-20852", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20852" }, { "name": "CVE-2012-2693", "url": "https://www.cve.org/CVERecord?id=CVE-2012-2693" }, { "name": "CVE-2018-7208", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7208" }, { "name": "CVE-2018-12910", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12910" }, { "name": "CVE-2019-8325", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8325" }, { "name": "CVE-2015-7497", "url": "https://www.cve.org/CVERecord?id=CVE-2015-7497" }, { "name": "CVE-2019-7665", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7665" }, { "name": "CVE-2018-15854", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15854" }, { "name": "CVE-2019-13404", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13404" }, { "name": "CVE-2015-5160", "url": "https://www.cve.org/CVERecord?id=CVE-2015-5160" }, { "name": "CVE-2018-10767", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10767" }, { "name": "CVE-2018-7550", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7550" }, { "name": "CVE-2016-3076", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3076" }, { "name": "CVE-2018-14404", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14404" }, { "name": "CVE-2018-18521", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18521" }, { "name": "CVE-2018-19788", "url": "https://www.cve.org/CVERecord?id=CVE-2018-19788" }, { "name": "CVE-2019-8322", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8322" }, { "name": "CVE-2019-3840", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3840" }, { "name": "CVE-2016-9189", "url": "https://www.cve.org/CVERecord?id=CVE-2016-9189" }, { "name": "CVE-2015-9262", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9262" }, { "name": "CVE-2018-14647", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14647" }, { "name": "CVE-2019-17041", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17041" }, { "name": "CVE-2019-14906", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14906" }, { "name": "CVE-2018-1000073", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000073" }, { "name": "CVE-2019-9947", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9947" }, { "name": "CVE-2017-1000158", "url": "https://www.cve.org/CVERecord?id=CVE-2017-1000158" }, { "name": "CVE-2019-7635", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7635" }, { "name": "CVE-2019-7576", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7576" }, { "name": "CVE-2019-14834", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14834" }, { "name": "CVE-2018-15855", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15855" }, { "name": "CVE-2019-7149", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7149" }, { "name": "CVE-2018-7642", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7642" }, { "name": "CVE-2019-5010", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5010" }, { "name": "CVE-2018-12641", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12641" }, { "name": "CVE-2021-3396", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3396" }, { "name": "CVE-2020-12403", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12403" }, { "name": "CVE-2017-15268", "url": "https://www.cve.org/CVERecord?id=CVE-2017-15268" }, { "name": "CVE-2018-15587", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15587" }, { "name": "CVE-2016-10746", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10746" }, { "name": "CVE-2017-13711", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13711" }, { "name": "CVE-2014-8131", "url": "https://www.cve.org/CVERecord?id=CVE-2014-8131" }, { "name": "CVE-2014-9601", "url": "https://www.cve.org/CVERecord?id=CVE-2014-9601" }, { "name": "CVE-2014-3657", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3657" }, { "name": "CVE-2018-10373", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10373" }, { "name": "CVE-2017-17790", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17790" }, { "name": "CVE-2011-2511", "url": "https://www.cve.org/CVERecord?id=CVE-2011-2511" }, { "name": "CVE-2018-1000802", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000802" }, { "name": "CVE-2017-7555", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7555" }, { "name": "CVE-2016-9015", "url": "https://www.cve.org/CVERecord?id=CVE-2016-9015" }, { "name": "CVE-2017-13720", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13720" }, { "name": "CVE-2018-11782", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11782" }, { "name": "CVE-2017-11671", "url": "https://www.cve.org/CVERecord?id=CVE-2017-11671" }, { "name": "CVE-2017-10664", "url": "https://www.cve.org/CVERecord?id=CVE-2017-10664" }, { "name": "CVE-2018-11213", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11213" }, { "name": "CVE-2013-6457", "url": "https://www.cve.org/CVERecord?id=CVE-2013-6457" }, { "name": "CVE-2019-10138", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10138" }, { "name": "CVE-2019-7578", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7578" }, { "name": "CVE-2020-7039", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7039" }, { "name": "CVE-2017-11368", "url": "https://www.cve.org/CVERecord?id=CVE-2017-11368" }, { "name": "CVE-2018-0494", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0494" }, { "name": "CVE-2019-20485", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20485" }, { "name": "CVE-2003-1418", "url": "https://www.cve.org/CVERecord?id=CVE-2003-1418" }, { "name": "CVE-2017-15289", "url": "https://www.cve.org/CVERecord?id=CVE-2017-15289" }, { "name": "CVE-2016-5391", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5391" }, { "name": "CVE-2017-2810", "url": "https://www.cve.org/CVERecord?id=CVE-2017-2810" }, { "name": "CVE-2018-15864", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15864" }, { "name": "CVE-2017-18207", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18207" }, { "name": "CVE-2019-12761", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12761" }, { "name": "CVE-2013-5651", "url": "https://www.cve.org/CVERecord?id=CVE-2013-5651" }, { "name": "CVE-2017-17522", "url": "https://www.cve.org/CVERecord?id=CVE-2017-17522" }, { "name": "CVE-2019-20382", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20382" }, { "name": "CVE-2016-2533", "url": "https://www.cve.org/CVERecord?id=CVE-2016-2533" }, { "name": "CVE-2019-14287", "url": "https://www.cve.org/CVERecord?id=CVE-2019-14287" }, { "name": "CVE-2018-18520", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18520" }, { "name": "CVE-2019-9740", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9740" }, { "name": "CVE-2019-7575", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7575" }, { "name": "CVE-2015-5652", "url": "https://www.cve.org/CVERecord?id=CVE-2015-5652" }, { "name": "CVE-2019-7572", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7572" }, { "name": "CVE-2017-6519", "url": "https://www.cve.org/CVERecord?id=CVE-2017-6519" }, { "name": "CVE-2018-10906", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10906" }, { "name": "CVE-2018-15863", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15863" }, { "name": "CVE-2018-15862", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15862" }, { "name": "CVE-2018-1000079", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000079" }, { "name": "CVE-2019-7664", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7664" }, { "name": "CVE-2017-5992", "url": "https://www.cve.org/CVERecord?id=CVE-2017-5992" }, { "name": "CVE-2019-16865", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16865" }, { "name": "CVE-2019-8324", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8324" }, { "name": "CVE-2018-1000076", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000076" }, { "name": "CVE-2018-1000030", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000030" }, { "name": "CVE-2018-1000074", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000074" }, { "name": "CVE-2017-0901", "url": "https://www.cve.org/CVERecord?id=CVE-2017-0901" }, { "name": "CVE-2018-7568", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7568" }, { "name": "CVE-2016-0775", "url": "https://www.cve.org/CVERecord?id=CVE-2016-0775" }, { "name": "CVE-2018-15688", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15688" }, { "name": "CVE-2018-14599", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14599" }, { "name": "CVE-2018-10733", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10733" }, { "name": "CVE-2016-9396", "url": "https://www.cve.org/CVERecord?id=CVE-2016-9396" }, { "name": "CVE-2019-10160", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10160" }, { "name": "CVE-2017-7562", "url": "https://www.cve.org/CVERecord?id=CVE-2017-7562" }, { "name": "CVE-2016-1000032", "url": "https://www.cve.org/CVERecord?id=CVE-2016-1000032" }, { "name": "CVE-2017-15124", "url": "https://www.cve.org/CVERecord?id=CVE-2017-15124" }, { "name": "CVE-2018-1113", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1113" }, { "name": "CVE-2013-4399", "url": "https://www.cve.org/CVERecord?id=CVE-2013-4399" }, { "name": "CVE-2019-7636", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7636" }, { "name": "CVE-2014-3672", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3672" }, { "name": "CVE-2018-4700", "url": "https://www.cve.org/CVERecord?id=CVE-2018-4700" }, { "name": "CVE-2017-0903", "url": "https://www.cve.org/CVERecord?id=CVE-2017-0903" }, { "name": "CVE-2018-15856", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15856" }, { "name": "CVE-2018-1000078", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000078" }, { "name": "CVE-2019-7573", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7573" }, { "name": "CVE-2018-1000077", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000077" }, { "name": "CVE-2010-2237", "url": "https://www.cve.org/CVERecord?id=CVE-2010-2237" }, { "name": "CVE-2018-1000876", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000876" }, { "name": "CVE-2018-14348", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14348" }, { "name": "CVE-2019-3890", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3890" }, { "name": "CVE-2015-7498", "url": "https://www.cve.org/CVERecord?id=CVE-2015-7498" }, { "name": "CVE-2019-7577", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7577" }, { "name": "CVE-2016-0740", "url": "https://www.cve.org/CVERecord?id=CVE-2016-0740" }, { "name": "CVE-2018-4180", "url": "https://www.cve.org/CVERecord?id=CVE-2018-4180" }, { "name": "CVE-2013-4297", "url": "https://www.cve.org/CVERecord?id=CVE-2013-4297" }, { "name": "CVE-2010-2238", "url": "https://www.cve.org/CVERecord?id=CVE-2010-2238" }, { "name": "CVE-2018-14600", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14600" }, { "name": "CVE-2017-13090", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13090" }, { "name": "CVE-2013-7336", "url": "https://www.cve.org/CVERecord?id=CVE-2013-7336" }, { "name": "CVE-2018-10372", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10372" }, { "name": "CVE-2019-7637", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7637" }, { "name": "CVE-2018-11806", "url": "https://www.cve.org/CVERecord?id=CVE-2018-11806" }, { "name": "CVE-2018-7643", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7643" }, { "name": "CVE-2015-0236", "url": "https://www.cve.org/CVERecord?id=CVE-2015-0236" }, { "name": "CVE-2018-1000117", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000117" }, { "name": "CVE-2014-0209", "url": "https://www.cve.org/CVERecord?id=CVE-2014-0209" }, { "name": "CVE-2013-2230", "url": "https://www.cve.org/CVERecord?id=CVE-2013-2230" }, { "name": "CVE-2018-1122", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1122" }, { "name": "CVE-2014-3960", "url": "https://www.cve.org/CVERecord?id=CVE-2014-3960" }, { "name": "CVE-2019-16056", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16056" }, { "name": "CVE-2020-12663", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12663" }, { "name": "CVE-2018-10768", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10768" }, { "name": "CVE-2017-16611", "url": "https://www.cve.org/CVERecord?id=CVE-2017-16611" }, { "name": "CVE-2014-7823", "url": "https://www.cve.org/CVERecord?id=CVE-2014-7823" }, { "name": "CVE-2020-10703", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10703" }, { "name": "CVE-2018-7569", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7569" }, { "name": "CVE-2013-4154", "url": "https://www.cve.org/CVERecord?id=CVE-2013-4154" }, { "name": "CVE-2018-20060", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20060" }, { "name": "CVE-2015-9382", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9382" }, { "name": "CVE-2017-18190", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18190" }, { "name": "CVE-2016-4009", "url": "https://www.cve.org/CVERecord?id=CVE-2016-4009" }, { "name": "CVE-2018-13033", "url": "https://www.cve.org/CVERecord?id=CVE-2018-13033" }, { "name": "CVE-2016-9190", "url": "https://www.cve.org/CVERecord?id=CVE-2016-9190" }, { "name": "CVE-2019-7574", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7574" }, { "name": "CVE-2016-0772", "url": "https://www.cve.org/CVERecord?id=CVE-2016-0772" }, { "name": "CVE-2016-5699", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5699" }, { "name": "CVE-2011-1486", "url": "https://www.cve.org/CVERecord?id=CVE-2011-1486" }, { "name": "CVE-2020-5208", "url": "https://www.cve.org/CVERecord?id=CVE-2020-5208" }, { "name": "CVE-2019-6778", "url": "https://www.cve.org/CVERecord?id=CVE-2019-6778" }, { "name": "CVE-2020-10772", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10772" }, { "name": "CVE-2020-25637", "url": "https://www.cve.org/CVERecord?id=CVE-2020-25637" }, { "name": "CVE-2018-10360", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10360" }, { "name": "CVE-2018-15859", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15859" }, { "name": "CVE-2017-13089", "url": "https://www.cve.org/CVERecord?id=CVE-2017-13089" }, { "name": "CVE-2019-12779", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12779" }, { "name": "CVE-2019-1010238", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1010238" }, { "name": "CVE-2019-6690", "url": "https://www.cve.org/CVERecord?id=CVE-2019-6690" }, { "name": "CVE-2015-8317", "url": "https://www.cve.org/CVERecord?id=CVE-2015-8317" }, { "name": "CVE-2018-4181", "url": "https://www.cve.org/CVERecord?id=CVE-2018-4181" }, { "name": "CVE-2019-8323", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8323" }, { "name": "CVE-2016-3616", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3616" }, { "name": "CVE-2018-14498", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14498" }, { "name": "CVE-2018-15861", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15861" }, { "name": "CVE-2019-7150", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7150" }, { "name": "CVE-2019-17042", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17042" }, { "name": "CVE-2016-5008", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5008" }, { "name": "CVE-2014-4616", "url": "https://www.cve.org/CVERecord?id=CVE-2014-4616" } ], "initial_release_date": "2022-03-23T00:00:00", "last_revision_date": "2022-03-23T00:00:00", "links": [], "reference": "CERTFR-2022-AVI-267", "revisions": [ { "description": "Version initiale", "revision_date": "2022-03-23T00:00:00.000000" } ], "risks": [ { "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Juniper Networks\nJunos Space. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de\ns\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans Juniper Networks Junos Space", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11176 du 22 mars 2022", "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11176\u0026cat=SIRT_1\u0026actp=LIST" } ] }
fkie_cve-2014-8991
Vulnerability from fkie_nvd
URL | Tags | ||
---|---|---|---|
cve@mitre.org | http://www.openwall.com/lists/oss-security/2014/11/19/17 | Mailing List, Third Party Advisory | |
cve@mitre.org | http://www.openwall.com/lists/oss-security/2014/11/20/6 | Mailing List, Third Party Advisory | |
cve@mitre.org | http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html | Third Party Advisory | |
cve@mitre.org | http://www.securityfocus.com/bid/71209 | Third Party Advisory, VDB Entry | |
cve@mitre.org | https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847 | Issue Tracking, Third Party Advisory | |
cve@mitre.org | https://github.com/pypa/pip/pull/2122 | Patch, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2014/11/19/17 | Mailing List, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2014/11/20/6 | Mailing List, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html | Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/71209 | Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847 | Issue Tracking, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/pypa/pip/pull/2122 | Patch, Vendor Advisory |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2B311CF-E147-4A9D-A90F-E5CC6B9A3AEE", "versionEndIncluding": "1.5.6", "versionStartIncluding": "1.3", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*", "matchCriteriaId": "0B1C288F-326B-497B-B26C-D26E01262DDB", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user." }, { "lang": "es", "value": "pip 1.3 hasta 1.5.6 permite a usuarios locales causar una denegaci\u00f3n de servicio (prevenci\u00f3n de la instalaci\u00f3n de paquetes) mediante la creaci\u00f3n de un fichero /tmp/pip-build-* para otro usuario." } ], "id": "CVE-2014-8991", "lastModified": "2025-04-12T10:46:40.837", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "LOW", "cvssData": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ] }, "published": "2014-11-24T15:59:15.640", "references": [ { "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17" }, { "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/71209" }, { "source": "cve@mitre.org", "tags": [ "Issue Tracking", "Third Party Advisory" ], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://github.com/pypa/pip/pull/2122" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/71209" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking", "Third Party Advisory" ], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://github.com/pypa/pip/pull/2122" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
opensuse-su-2024:11251-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "python36-pip-20.2.4-1.8 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the python36-pip-20.2.4-1.8 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-11251", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11251-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2013-5123 page", "url": "https://www.suse.com/security/cve/CVE-2013-5123/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-8991 page", "url": "https://www.suse.com/security/cve/CVE-2014-8991/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-2296 page", "url": "https://www.suse.com/security/cve/CVE-2015-2296/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20916 page", "url": "https://www.suse.com/security/cve/CVE-2019-20916/" } ], "title": "python36-pip-20.2.4-1.8 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:11251-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "python36-pip-20.2.4-1.8.aarch64", "product": { "name": "python36-pip-20.2.4-1.8.aarch64", "product_id": "python36-pip-20.2.4-1.8.aarch64" } }, { "category": "product_version", "name": "python38-pip-20.2.4-1.8.aarch64", "product": { "name": "python38-pip-20.2.4-1.8.aarch64", "product_id": "python38-pip-20.2.4-1.8.aarch64" } }, { "category": "product_version", "name": "python39-pip-20.2.4-1.8.aarch64", "product": { "name": "python39-pip-20.2.4-1.8.aarch64", "product_id": "python39-pip-20.2.4-1.8.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "python36-pip-20.2.4-1.8.ppc64le", "product": { "name": "python36-pip-20.2.4-1.8.ppc64le", "product_id": "python36-pip-20.2.4-1.8.ppc64le" } }, { "category": "product_version", "name": "python38-pip-20.2.4-1.8.ppc64le", "product": { "name": "python38-pip-20.2.4-1.8.ppc64le", "product_id": "python38-pip-20.2.4-1.8.ppc64le" } }, { "category": "product_version", "name": "python39-pip-20.2.4-1.8.ppc64le", "product": { "name": "python39-pip-20.2.4-1.8.ppc64le", "product_id": "python39-pip-20.2.4-1.8.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "python36-pip-20.2.4-1.8.s390x", "product": { "name": "python36-pip-20.2.4-1.8.s390x", "product_id": "python36-pip-20.2.4-1.8.s390x" } }, { "category": "product_version", "name": "python38-pip-20.2.4-1.8.s390x", "product": { "name": "python38-pip-20.2.4-1.8.s390x", "product_id": "python38-pip-20.2.4-1.8.s390x" } }, { "category": "product_version", "name": "python39-pip-20.2.4-1.8.s390x", "product": { "name": "python39-pip-20.2.4-1.8.s390x", "product_id": "python39-pip-20.2.4-1.8.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "python36-pip-20.2.4-1.8.x86_64", "product": { "name": "python36-pip-20.2.4-1.8.x86_64", "product_id": "python36-pip-20.2.4-1.8.x86_64" } }, { "category": "product_version", "name": "python38-pip-20.2.4-1.8.x86_64", "product": { "name": "python38-pip-20.2.4-1.8.x86_64", "product_id": "python38-pip-20.2.4-1.8.x86_64" } }, { "category": "product_version", "name": "python39-pip-20.2.4-1.8.x86_64", "product": { "name": "python39-pip-20.2.4-1.8.x86_64", "product_id": "python39-pip-20.2.4-1.8.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python36-pip-20.2.4-1.8.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64" }, "product_reference": "python36-pip-20.2.4-1.8.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python36-pip-20.2.4-1.8.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le" }, "product_reference": "python36-pip-20.2.4-1.8.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python36-pip-20.2.4-1.8.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x" }, "product_reference": "python36-pip-20.2.4-1.8.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python36-pip-20.2.4-1.8.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64" }, "product_reference": "python36-pip-20.2.4-1.8.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python38-pip-20.2.4-1.8.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64" }, "product_reference": "python38-pip-20.2.4-1.8.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python38-pip-20.2.4-1.8.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le" }, "product_reference": "python38-pip-20.2.4-1.8.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python38-pip-20.2.4-1.8.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x" }, "product_reference": "python38-pip-20.2.4-1.8.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python38-pip-20.2.4-1.8.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64" }, "product_reference": "python38-pip-20.2.4-1.8.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python39-pip-20.2.4-1.8.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64" }, "product_reference": "python39-pip-20.2.4-1.8.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python39-pip-20.2.4-1.8.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le" }, "product_reference": "python39-pip-20.2.4-1.8.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python39-pip-20.2.4-1.8.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x" }, "product_reference": "python39-pip-20.2.4-1.8.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python39-pip-20.2.4-1.8.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" }, "product_reference": "python39-pip-20.2.4-1.8.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2013-5123", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-5123" } ], "notes": [ { "category": "general", "text": "The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-5123", "url": "https://www.suse.com/security/cve/CVE-2013-5123" }, { "category": "external", "summary": "SUSE Bug 864406 for CVE-2013-5123", "url": "https://bugzilla.suse.com/864406" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-5123" }, { "cve": "CVE-2014-8991", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-8991" } ], "notes": [ { "category": "general", "text": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-8991", "url": "https://www.suse.com/security/cve/CVE-2014-8991" }, { "category": "external", "summary": "SUSE Bug 907038 for CVE-2014-8991", "url": "https://bugzilla.suse.com/907038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2014-8991" }, { "cve": "CVE-2015-2296", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2015-2296" } ], "notes": [ { "category": "general", "text": "The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2015-2296", "url": "https://www.suse.com/security/cve/CVE-2015-2296" }, { "category": "external", "summary": "SUSE Bug 922448 for CVE-2015-2296", "url": "https://bugzilla.suse.com/922448" }, { "category": "external", "summary": "SUSE Bug 926396 for CVE-2015-2296", "url": "https://bugzilla.suse.com/926396" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2015-2296" }, { "cve": "CVE-2019-20916", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20916" } ], "notes": [ { "category": "general", "text": "The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20916", "url": "https://www.suse.com/security/cve/CVE-2019-20916" }, { "category": "external", "summary": "SUSE Bug 1176262 for CVE-2019-20916", "url": "https://bugzilla.suse.com/1176262" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python36-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python38-pip-20.2.4-1.8.x86_64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.aarch64", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.ppc64le", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.s390x", "openSUSE Tumbleweed:python39-pip-20.2.4-1.8.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-20916" } ] }
opensuse-su-2024:13916-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "python310-pip-24.0-1.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the python310-pip-24.0-1.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-13916", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13916-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2013-5123 page", "url": "https://www.suse.com/security/cve/CVE-2013-5123/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-8991 page", "url": "https://www.suse.com/security/cve/CVE-2014-8991/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-2296 page", "url": "https://www.suse.com/security/cve/CVE-2015-2296/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20916 page", "url": "https://www.suse.com/security/cve/CVE-2019-20916/" } ], "title": "python310-pip-24.0-1.1 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:13916-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "python310-pip-24.0-1.1.aarch64", "product": { "name": "python310-pip-24.0-1.1.aarch64", "product_id": "python310-pip-24.0-1.1.aarch64" } }, { "category": "product_version", "name": "python310-pip-wheel-24.0-1.1.aarch64", "product": { "name": "python310-pip-wheel-24.0-1.1.aarch64", "product_id": "python310-pip-wheel-24.0-1.1.aarch64" } }, { "category": "product_version", "name": "python311-pip-24.0-1.1.aarch64", "product": { "name": "python311-pip-24.0-1.1.aarch64", "product_id": "python311-pip-24.0-1.1.aarch64" } }, { "category": "product_version", "name": "python311-pip-wheel-24.0-1.1.aarch64", "product": { "name": "python311-pip-wheel-24.0-1.1.aarch64", "product_id": "python311-pip-wheel-24.0-1.1.aarch64" } }, { "category": "product_version", "name": "python312-pip-24.0-1.1.aarch64", "product": { "name": "python312-pip-24.0-1.1.aarch64", "product_id": "python312-pip-24.0-1.1.aarch64" } }, { "category": "product_version", "name": "python312-pip-wheel-24.0-1.1.aarch64", "product": { "name": "python312-pip-wheel-24.0-1.1.aarch64", "product_id": "python312-pip-wheel-24.0-1.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "python310-pip-24.0-1.1.ppc64le", "product": { "name": "python310-pip-24.0-1.1.ppc64le", "product_id": "python310-pip-24.0-1.1.ppc64le" } }, { "category": "product_version", "name": "python310-pip-wheel-24.0-1.1.ppc64le", "product": { "name": "python310-pip-wheel-24.0-1.1.ppc64le", "product_id": "python310-pip-wheel-24.0-1.1.ppc64le" } }, { "category": "product_version", "name": "python311-pip-24.0-1.1.ppc64le", "product": { "name": "python311-pip-24.0-1.1.ppc64le", "product_id": "python311-pip-24.0-1.1.ppc64le" } }, { "category": "product_version", "name": "python311-pip-wheel-24.0-1.1.ppc64le", "product": { "name": "python311-pip-wheel-24.0-1.1.ppc64le", "product_id": "python311-pip-wheel-24.0-1.1.ppc64le" } }, { "category": "product_version", "name": "python312-pip-24.0-1.1.ppc64le", "product": { "name": "python312-pip-24.0-1.1.ppc64le", "product_id": "python312-pip-24.0-1.1.ppc64le" } }, { "category": "product_version", "name": "python312-pip-wheel-24.0-1.1.ppc64le", "product": { "name": "python312-pip-wheel-24.0-1.1.ppc64le", "product_id": "python312-pip-wheel-24.0-1.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "python310-pip-24.0-1.1.s390x", "product": { "name": "python310-pip-24.0-1.1.s390x", "product_id": "python310-pip-24.0-1.1.s390x" } }, { "category": "product_version", "name": "python310-pip-wheel-24.0-1.1.s390x", "product": { "name": "python310-pip-wheel-24.0-1.1.s390x", "product_id": "python310-pip-wheel-24.0-1.1.s390x" } }, { "category": "product_version", "name": "python311-pip-24.0-1.1.s390x", "product": { "name": "python311-pip-24.0-1.1.s390x", "product_id": "python311-pip-24.0-1.1.s390x" } }, { "category": "product_version", "name": "python311-pip-wheel-24.0-1.1.s390x", "product": { "name": "python311-pip-wheel-24.0-1.1.s390x", "product_id": "python311-pip-wheel-24.0-1.1.s390x" } }, { "category": "product_version", "name": "python312-pip-24.0-1.1.s390x", "product": { "name": "python312-pip-24.0-1.1.s390x", "product_id": "python312-pip-24.0-1.1.s390x" } }, { "category": "product_version", "name": "python312-pip-wheel-24.0-1.1.s390x", "product": { "name": "python312-pip-wheel-24.0-1.1.s390x", "product_id": "python312-pip-wheel-24.0-1.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "python310-pip-24.0-1.1.x86_64", "product": { "name": "python310-pip-24.0-1.1.x86_64", "product_id": "python310-pip-24.0-1.1.x86_64" } }, { "category": "product_version", "name": "python310-pip-wheel-24.0-1.1.x86_64", "product": { "name": "python310-pip-wheel-24.0-1.1.x86_64", "product_id": "python310-pip-wheel-24.0-1.1.x86_64" } }, { "category": "product_version", "name": "python311-pip-24.0-1.1.x86_64", "product": { "name": "python311-pip-24.0-1.1.x86_64", "product_id": "python311-pip-24.0-1.1.x86_64" } }, { "category": "product_version", "name": "python311-pip-wheel-24.0-1.1.x86_64", "product": { "name": "python311-pip-wheel-24.0-1.1.x86_64", "product_id": "python311-pip-wheel-24.0-1.1.x86_64" } }, { "category": "product_version", "name": "python312-pip-24.0-1.1.x86_64", "product": { "name": "python312-pip-24.0-1.1.x86_64", "product_id": "python312-pip-24.0-1.1.x86_64" } }, { "category": "product_version", "name": "python312-pip-wheel-24.0-1.1.x86_64", "product": { "name": "python312-pip-wheel-24.0-1.1.x86_64", "product_id": "python312-pip-wheel-24.0-1.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python310-pip-24.0-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64" }, "product_reference": "python310-pip-24.0-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python310-pip-24.0-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le" }, "product_reference": "python310-pip-24.0-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python310-pip-24.0-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x" }, "product_reference": "python310-pip-24.0-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python310-pip-24.0-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64" }, "product_reference": "python310-pip-24.0-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python310-pip-wheel-24.0-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64" }, "product_reference": "python310-pip-wheel-24.0-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python310-pip-wheel-24.0-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le" }, "product_reference": "python310-pip-wheel-24.0-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python310-pip-wheel-24.0-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x" }, "product_reference": "python310-pip-wheel-24.0-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python310-pip-wheel-24.0-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64" }, "product_reference": "python310-pip-wheel-24.0-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python311-pip-24.0-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64" }, "product_reference": "python311-pip-24.0-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python311-pip-24.0-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le" }, "product_reference": "python311-pip-24.0-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python311-pip-24.0-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x" }, "product_reference": "python311-pip-24.0-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python311-pip-24.0-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64" }, "product_reference": "python311-pip-24.0-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python311-pip-wheel-24.0-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64" }, "product_reference": "python311-pip-wheel-24.0-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python311-pip-wheel-24.0-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le" }, "product_reference": "python311-pip-wheel-24.0-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python311-pip-wheel-24.0-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x" }, "product_reference": "python311-pip-wheel-24.0-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python311-pip-wheel-24.0-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64" }, "product_reference": "python311-pip-wheel-24.0-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python312-pip-24.0-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64" }, "product_reference": "python312-pip-24.0-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python312-pip-24.0-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le" }, "product_reference": "python312-pip-24.0-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python312-pip-24.0-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x" }, "product_reference": "python312-pip-24.0-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python312-pip-24.0-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64" }, "product_reference": "python312-pip-24.0-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python312-pip-wheel-24.0-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64" }, "product_reference": "python312-pip-wheel-24.0-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python312-pip-wheel-24.0-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le" }, "product_reference": "python312-pip-wheel-24.0-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python312-pip-wheel-24.0-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x" }, "product_reference": "python312-pip-wheel-24.0-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python312-pip-wheel-24.0-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" }, "product_reference": "python312-pip-wheel-24.0-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2013-5123", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-5123" } ], "notes": [ { "category": "general", "text": "The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-5123", "url": "https://www.suse.com/security/cve/CVE-2013-5123" }, { "category": "external", "summary": "SUSE Bug 864406 for CVE-2013-5123", "url": "https://bugzilla.suse.com/864406" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-5123" }, { "cve": "CVE-2014-8991", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-8991" } ], "notes": [ { "category": "general", "text": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-8991", "url": "https://www.suse.com/security/cve/CVE-2014-8991" }, { "category": "external", "summary": "SUSE Bug 907038 for CVE-2014-8991", "url": "https://bugzilla.suse.com/907038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2014-8991" }, { "cve": "CVE-2015-2296", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2015-2296" } ], "notes": [ { "category": "general", "text": "The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2015-2296", "url": "https://www.suse.com/security/cve/CVE-2015-2296" }, { "category": "external", "summary": "SUSE Bug 922448 for CVE-2015-2296", "url": "https://bugzilla.suse.com/922448" }, { "category": "external", "summary": "SUSE Bug 926396 for CVE-2015-2296", "url": "https://bugzilla.suse.com/926396" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2015-2296" }, { "cve": "CVE-2019-20916", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20916" } ], "notes": [ { "category": "general", "text": "The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20916", "url": "https://www.suse.com/security/cve/CVE-2019-20916" }, { "category": "external", "summary": "SUSE Bug 1176262 for CVE-2019-20916", "url": "https://bugzilla.suse.com/1176262" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python310-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python310-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python311-pip-wheel-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-24.0-1.1.x86_64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.aarch64", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.ppc64le", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.s390x", "openSUSE Tumbleweed:python312-pip-wheel-24.0-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-20916" } ] }
opensuse-su-2024:11281-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "python2-pip-20.0.2-2.6 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the python2-pip-20.0.2-2.6 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-11281", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11281-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2013-5123 page", "url": "https://www.suse.com/security/cve/CVE-2013-5123/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-8991 page", "url": "https://www.suse.com/security/cve/CVE-2014-8991/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-2296 page", "url": "https://www.suse.com/security/cve/CVE-2015-2296/" } ], "title": "python2-pip-20.0.2-2.6 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:11281-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "python2-pip-20.0.2-2.6.aarch64", "product": { "name": "python2-pip-20.0.2-2.6.aarch64", "product_id": "python2-pip-20.0.2-2.6.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "python2-pip-20.0.2-2.6.ppc64le", "product": { "name": "python2-pip-20.0.2-2.6.ppc64le", "product_id": "python2-pip-20.0.2-2.6.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "python2-pip-20.0.2-2.6.s390x", "product": { "name": "python2-pip-20.0.2-2.6.s390x", "product_id": "python2-pip-20.0.2-2.6.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "python2-pip-20.0.2-2.6.x86_64", "product": { "name": "python2-pip-20.0.2-2.6.x86_64", "product_id": "python2-pip-20.0.2-2.6.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python2-pip-20.0.2-2.6.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.aarch64" }, "product_reference": "python2-pip-20.0.2-2.6.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python2-pip-20.0.2-2.6.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.ppc64le" }, "product_reference": "python2-pip-20.0.2-2.6.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python2-pip-20.0.2-2.6.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.s390x" }, "product_reference": "python2-pip-20.0.2-2.6.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python2-pip-20.0.2-2.6.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.x86_64" }, "product_reference": "python2-pip-20.0.2-2.6.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2013-5123", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-5123" } ], "notes": [ { "category": "general", "text": "The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.aarch64", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.ppc64le", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.s390x", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-5123", "url": "https://www.suse.com/security/cve/CVE-2013-5123" }, { "category": "external", "summary": "SUSE Bug 864406 for CVE-2013-5123", "url": "https://bugzilla.suse.com/864406" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.aarch64", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.ppc64le", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.s390x", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.aarch64", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.ppc64le", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.s390x", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-5123" }, { "cve": "CVE-2014-8991", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-8991" } ], "notes": [ { "category": "general", "text": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.aarch64", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.ppc64le", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.s390x", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-8991", "url": "https://www.suse.com/security/cve/CVE-2014-8991" }, { "category": "external", "summary": "SUSE Bug 907038 for CVE-2014-8991", "url": "https://bugzilla.suse.com/907038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.aarch64", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.ppc64le", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.s390x", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.aarch64", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.ppc64le", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.s390x", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2014-8991" }, { "cve": "CVE-2015-2296", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2015-2296" } ], "notes": [ { "category": "general", "text": "The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.aarch64", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.ppc64le", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.s390x", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2015-2296", "url": "https://www.suse.com/security/cve/CVE-2015-2296" }, { "category": "external", "summary": "SUSE Bug 922448 for CVE-2015-2296", "url": "https://bugzilla.suse.com/922448" }, { "category": "external", "summary": "SUSE Bug 926396 for CVE-2015-2296", "url": "https://bugzilla.suse.com/926396" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.aarch64", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.ppc64le", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.s390x", "openSUSE Tumbleweed:python2-pip-20.0.2-2.6.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2015-2296" } ] }
opensuse-su-2024:10098-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "python-pip-8.1.2-1.2 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the python-pip-8.1.2-1.2 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-10098", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10098-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2013-5123 page", "url": "https://www.suse.com/security/cve/CVE-2013-5123/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-8991 page", "url": "https://www.suse.com/security/cve/CVE-2014-8991/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-2296 page", "url": "https://www.suse.com/security/cve/CVE-2015-2296/" } ], "title": "python-pip-8.1.2-1.2 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:10098-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "python-pip-8.1.2-1.2.aarch64", "product": { "name": "python-pip-8.1.2-1.2.aarch64", "product_id": "python-pip-8.1.2-1.2.aarch64" } }, { "category": "product_version", "name": "python3-pip-9.0.1-1.1.aarch64", "product": { "name": "python3-pip-9.0.1-1.1.aarch64", "product_id": "python3-pip-9.0.1-1.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "python-pip-8.1.2-1.2.ppc64le", "product": { "name": "python-pip-8.1.2-1.2.ppc64le", "product_id": "python-pip-8.1.2-1.2.ppc64le" } }, { "category": "product_version", "name": "python3-pip-9.0.1-1.1.ppc64le", "product": { "name": "python3-pip-9.0.1-1.1.ppc64le", "product_id": "python3-pip-9.0.1-1.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "python-pip-8.1.2-1.2.s390x", "product": { "name": "python-pip-8.1.2-1.2.s390x", "product_id": "python-pip-8.1.2-1.2.s390x" } }, { "category": "product_version", "name": "python3-pip-9.0.1-1.1.s390x", "product": { "name": "python3-pip-9.0.1-1.1.s390x", "product_id": "python3-pip-9.0.1-1.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "python-pip-8.1.2-1.2.x86_64", "product": { "name": "python-pip-8.1.2-1.2.x86_64", "product_id": "python-pip-8.1.2-1.2.x86_64" } }, { "category": "product_version", "name": "python3-pip-9.0.1-1.1.x86_64", "product": { "name": "python3-pip-9.0.1-1.1.x86_64", "product_id": "python3-pip-9.0.1-1.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python-pip-8.1.2-1.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python-pip-8.1.2-1.2.aarch64" }, "product_reference": "python-pip-8.1.2-1.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python-pip-8.1.2-1.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python-pip-8.1.2-1.2.ppc64le" }, "product_reference": "python-pip-8.1.2-1.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python-pip-8.1.2-1.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python-pip-8.1.2-1.2.s390x" }, "product_reference": "python-pip-8.1.2-1.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python-pip-8.1.2-1.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python-pip-8.1.2-1.2.x86_64" }, "product_reference": "python-pip-8.1.2-1.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python3-pip-9.0.1-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.aarch64" }, "product_reference": "python3-pip-9.0.1-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python3-pip-9.0.1-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.ppc64le" }, "product_reference": "python3-pip-9.0.1-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python3-pip-9.0.1-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.s390x" }, "product_reference": "python3-pip-9.0.1-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "python3-pip-9.0.1-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.x86_64" }, "product_reference": "python3-pip-9.0.1-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2013-5123", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-5123" } ], "notes": [ { "category": "general", "text": "The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python-pip-8.1.2-1.2.aarch64", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.ppc64le", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.s390x", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.x86_64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.aarch64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.ppc64le", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.s390x", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-5123", "url": "https://www.suse.com/security/cve/CVE-2013-5123" }, { "category": "external", "summary": "SUSE Bug 864406 for CVE-2013-5123", "url": "https://bugzilla.suse.com/864406" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python-pip-8.1.2-1.2.aarch64", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.ppc64le", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.s390x", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.x86_64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.aarch64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.ppc64le", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.s390x", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python-pip-8.1.2-1.2.aarch64", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.ppc64le", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.s390x", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.x86_64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.aarch64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.ppc64le", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.s390x", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-5123" }, { "cve": "CVE-2014-8991", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-8991" } ], "notes": [ { "category": "general", "text": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python-pip-8.1.2-1.2.aarch64", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.ppc64le", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.s390x", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.x86_64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.aarch64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.ppc64le", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.s390x", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-8991", "url": "https://www.suse.com/security/cve/CVE-2014-8991" }, { "category": "external", "summary": "SUSE Bug 907038 for CVE-2014-8991", "url": "https://bugzilla.suse.com/907038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python-pip-8.1.2-1.2.aarch64", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.ppc64le", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.s390x", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.x86_64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.aarch64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.ppc64le", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.s390x", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:python-pip-8.1.2-1.2.aarch64", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.ppc64le", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.s390x", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.x86_64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.aarch64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.ppc64le", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.s390x", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2014-8991" }, { "cve": "CVE-2015-2296", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2015-2296" } ], "notes": [ { "category": "general", "text": "The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:python-pip-8.1.2-1.2.aarch64", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.ppc64le", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.s390x", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.x86_64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.aarch64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.ppc64le", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.s390x", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2015-2296", "url": "https://www.suse.com/security/cve/CVE-2015-2296" }, { "category": "external", "summary": "SUSE Bug 922448 for CVE-2015-2296", "url": "https://bugzilla.suse.com/922448" }, { "category": "external", "summary": "SUSE Bug 926396 for CVE-2015-2296", "url": "https://bugzilla.suse.com/926396" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:python-pip-8.1.2-1.2.aarch64", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.ppc64le", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.s390x", "openSUSE Tumbleweed:python-pip-8.1.2-1.2.x86_64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.aarch64", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.ppc64le", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.s390x", "openSUSE Tumbleweed:python3-pip-9.0.1-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2015-2296" } ] }
gsd-2014-8991
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2014-8991", "description": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "id": "GSD-2014-8991", "references": [ "https://www.suse.com/security/cve/CVE-2014-8991.html", "https://advisories.mageia.org/CVE-2014-8991.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2014-8991" ], "details": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.", "id": "GSD-2014-8991", "modified": "2023-12-13T01:22:49.409684Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-8991", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "[oss-security] 20141117 Requesting a CVE for pip - Local DoS with predictable temp directory names", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17" }, { "name": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" }, { "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847", "refsource": "CONFIRM", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847" }, { "name": "71209", "refsource": "BID", "url": "http://www.securityfocus.com/bid/71209" }, { "name": "[oss-security] 20141120 Re: Requesting a CVE for pip - Local DoS with predictable temp directory names", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6" }, { "name": "https://github.com/pypa/pip/pull/2122", "refsource": "CONFIRM", "url": "https://github.com/pypa/pip/pull/2122" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.5.6", "versionStartIncluding": "1.3", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-8991" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/pypa/pip/pull/2122", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://github.com/pypa/pip/pull/2122" }, { "name": "71209", "refsource": "BID", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/71209" }, { "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847", "refsource": "CONFIRM", "tags": [ "Issue Tracking", "Third Party Advisory" ], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847" }, { "name": "[oss-security] 20141117 Requesting a CVE for pip - Local DoS with predictable temp directory names", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/19/17" }, { "name": "[oss-security] 20141120 Re: Requesting a CVE for pip - Local DoS with predictable temp directory names", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2014/11/20/6" }, { "name": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false } }, "lastModifiedDate": "2021-03-15T16:17Z", "publishedDate": "2014-11-24T15:59Z" } } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.