{
  "document": {
    "acknowledgments": [
      {
        "summary": "Cisco would like to thank Simon Scannell for reporting this vulnerability."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r\n\r\nA vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r\nThis vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r\nFor a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html\"].\r\n\r\nNotes:\r\n\r\nThe Security Impact Rating (SIR) for this vulnerability is Critical only for Windows-based platforms because those platforms run the ClamAV scanning process in a privileged security context. The platforms that are critically impacted include Cisco Secure Endpoint Connector for Windows.\r\nThe SIR for this vulnerability is Medium on other platforms, including Linux and Mac platforms, because those platforms run the ClamAV scanning process in a lower-privileged security context. The affected platforms include Cisco Secure Web Appliance and Secure Endpoint Connector for Linux and Mac.\r\nCisco Secure Endpoint Private Cloud itself is not impacted by this vulnerability. However, the Secure Endpoint Connector software that is distributed from the device is impacted.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Cisco investigated its product line to determine which products may be affected by this vulnerability.\r\n\r\nThe Vulnerable Products [\"#vp\"] section includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool [\"https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID\"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.\r\n\r\nAny product not listed in the Vulnerable Products section of this advisory is to be considered not vulnerable.",
        "title": "Affected Products"
      },
      {
        "category": "general",
        "text": "The following table lists Cisco products that are affected by the vulnerability that is described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes.\r\n        Cisco Product  Cisco Bug ID  Fixed Release Availability [\"https://tools.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"]          Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Linux  CSCwd74133 [\"https://bst.cisco.com/bugsearch/bug/CSCwd74133\"]  1.20.21      Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for MacOS  CSCwd74134 [\"https://bst.cisco.com/bugsearch/bug/CSCwd74134\"]  1.21.11      Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Windows  CSCwd74135 [\"https://bst.cisco.com/bugsearch/bug/CSCwd74135\"]  7.5.9 1\r\n8.1.5      Secure Endpoint Private Cloud  CSCwe18204 [\"https://bst.cisco.com/bugsearch/bug/CSCwe18204\"]  3.6.0 or later with updated connectors2      Secure Web Appliance, formerly Web Security Appliance  CSCwd74132 [\"https://bst.cisco.com/bugsearch/bug/CSCwd74132\"]  12.5.6 (May 2023)\r\n14.0.4-005\r\n14.5.1-013 (Mar 2023)\r\n15.0.0-254 (April 2023)\r\n1. Updated releases of Cisco Secure Endpoint are available through the Cisco Secure Endpoint [\"https://console.amp.cisco.com/\"] portal. Depending on the configured policy, Cisco Secure Endpoint will automatically update.\r\n2. Affected releases of Cisco Secure Endpoint clients for Cisco Secure Endpoint Private Cloud have been updated in the connectors repository. Customers will get these connector updates through normal content update processes.\r\nAttention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see Meet Cisco Secure [\"https://www.cisco.com/c/en/us/products/security/secure-names.html\"].",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nSecure Email Gateway, formerly Email Security Appliance\r\nSecure Email and Web Manager, formerly Security Management Appliance",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address this vulnerability.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "For information about fixed software releases [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], consult the Cisco bugs identified in the Vulnerable Products [\"#vp\"] section of this advisory.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page, to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco Product Security Incident Response Team (PSIRT) is aware that a proof-of-concept is available that demonstrates that this vulnerability can be used to cause a buffer overflow and subsequent process termination.\r\n\r\nAdditional technical information is also available that describes this vulnerability in detail.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "Cisco would like to thank Simon Scannell for reporting this vulnerability.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "ClamAV blog",
        "url": "https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html"
      },
      {
        "category": "external",
        "summary": "Cisco Bug Search Tool",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"
      },
      {
        "category": "external",
        "summary": "Fixed Release Availability",
        "url": "https://tools.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "CSCwd74133",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwd74133"
      },
      {
        "category": "external",
        "summary": "CSCwd74134",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwd74134"
      },
      {
        "category": "external",
        "summary": "CSCwd74135",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwd74135"
      },
      {
        "category": "external",
        "summary": "CSCwe18204",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwe18204"
      },
      {
        "category": "external",
        "summary": "CSCwd74132",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwd74132"
      },
      {
        "category": "external",
        "summary": "Cisco Secure Endpoint",
        "url": "https://console.amp.cisco.com/"
      },
      {
        "category": "external",
        "summary": "Meet Cisco Secure",
        "url": "https://www.cisco.com/c/en/us/products/security/secure-names.html"
      },
      {
        "category": "external",
        "summary": "fixed software releases",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisories",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      }
    ],
    "title": "ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023",
    "tracking": {
      "current_release_date": "2023-02-22T14:09:19+00:00",
      "generator": {
        "date": "2024-05-10T23:21:52+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-clamav-q8DThCy",
      "initial_release_date": "2023-02-15T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2023-02-15T15:53:37+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2023-02-15T20:14:36+00:00",
          "number": "1.1.0",
          "summary": "Changed date of ClamAV disclosure to February 15."
        },
        {
          "date": "2023-02-17T19:43:51+00:00",
          "number": "1.2.0",
          "summary": "Added two more fixed releases and availability dates for Secure Web Appliance."
        },
        {
          "date": "2023-02-21T14:26:24+00:00",
          "number": "1.3.0",
          "summary": "Clarified the vulnerability impacts based on platform. Updated the link to the ClamAV blog."
        },
        {
          "date": "2023-02-22T14:09:19+00:00",
          "number": "1.4.0",
          "summary": "Updated proof-of-concept information."
        }
      ],
      "status": "final",
      "version": "1.4.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Secure Web Appliance",
            "product": {
              "name": "Cisco Secure Web Appliance ",
              "product_id": "CSAFPID-189789"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Secure Endpoint",
            "product": {
              "name": "Cisco Secure Endpoint ",
              "product_id": "CSAFPID-221075"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Secure Endpoint Private Cloud Administration Portal",
            "product": {
              "name": "Cisco Secure Endpoint Private Cloud Administration Portal ",
              "product_id": "CSAFPID-292706"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20032",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd74135"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd74134"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd74133"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwe18204"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd74132"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-221075",
          "CSAFPID-292706",
          "CSAFPID-189789"
        ]
      },
      "release_date": "2023-02-15T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-221075",
            "CSAFPID-292706",
            "CSAFPID-189789"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-221075",
            "CSAFPID-292706",
            "CSAFPID-189789"
          ]
        }
      ],
      "title": "ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "summary": "Cisco would like to thank Simon Scannell for reporting this vulnerability."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r\n\r\nA vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r\nThis vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r\nFor a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html\"].\r\n\r\nNotes:\r\n\r\nThe Security Impact Rating (SIR) for this vulnerability is Critical only for Windows-based platforms because those platforms run the ClamAV scanning process in a privileged security context. The platforms that are critically impacted include Cisco Secure Endpoint Connector for Windows.\r\nThe SIR for this vulnerability is Medium on other platforms, including Linux and Mac platforms, because those platforms run the ClamAV scanning process in a lower-privileged security context. The affected platforms include Cisco Secure Web Appliance and Secure Endpoint Connector for Linux and Mac.\r\nCisco Secure Endpoint Private Cloud itself is not impacted by this vulnerability. However, the Secure Endpoint Connector software that is distributed from the device is impacted.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Cisco investigated its product line to determine which products may be affected by this vulnerability.\r\n\r\nThe Vulnerable Products [\"#vp\"] section includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool [\"https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID\"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.\r\n\r\nAny product not listed in the Vulnerable Products section of this advisory is to be considered not vulnerable.",
        "title": "Affected Products"
      },
      {
        "category": "general",
        "text": "The following table lists Cisco products that are affected by the vulnerability that is described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes.\r\n        Cisco Product  Cisco Bug ID  Fixed Release Availability [\"https://tools.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"]          Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Linux  CSCwd74133 [\"https://bst.cisco.com/bugsearch/bug/CSCwd74133\"]  1.20.21      Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for MacOS  CSCwd74134 [\"https://bst.cisco.com/bugsearch/bug/CSCwd74134\"]  1.21.11      Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Windows  CSCwd74135 [\"https://bst.cisco.com/bugsearch/bug/CSCwd74135\"]  7.5.9 1\r\n8.1.5      Secure Endpoint Private Cloud  CSCwe18204 [\"https://bst.cisco.com/bugsearch/bug/CSCwe18204\"]  3.6.0 or later with updated connectors2      Secure Web Appliance, formerly Web Security Appliance  CSCwd74132 [\"https://bst.cisco.com/bugsearch/bug/CSCwd74132\"]  12.5.6 (May 2023)\r\n14.0.4-005\r\n14.5.1-013 (Mar 2023)\r\n15.0.0-254 (April 2023)\r\n1. Updated releases of Cisco Secure Endpoint are available through the Cisco Secure Endpoint [\"https://console.amp.cisco.com/\"] portal. Depending on the configured policy, Cisco Secure Endpoint will automatically update.\r\n2. Affected releases of Cisco Secure Endpoint clients for Cisco Secure Endpoint Private Cloud have been updated in the connectors repository. Customers will get these connector updates through normal content update processes.\r\nAttention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see Meet Cisco Secure [\"https://www.cisco.com/c/en/us/products/security/secure-names.html\"].",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nSecure Email Gateway, formerly Email Security Appliance\r\nSecure Email and Web Manager, formerly Security Management Appliance",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address this vulnerability.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "For information about fixed software releases [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], consult the Cisco bugs identified in the Vulnerable Products [\"#vp\"] section of this advisory.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page, to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco Product Security Incident Response Team (PSIRT) is aware that a proof-of-concept is available that demonstrates that this vulnerability can be used to cause a buffer overflow and subsequent process termination.\r\n\r\nAdditional technical information is also available that describes this vulnerability in detail.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "Cisco would like to thank Simon Scannell for reporting this vulnerability.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "ClamAV blog",
        "url": "https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html"
      },
      {
        "category": "external",
        "summary": "Cisco Bug Search Tool",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"
      },
      {
        "category": "external",
        "summary": "Fixed Release Availability",
        "url": "https://tools.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "CSCwd74133",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwd74133"
      },
      {
        "category": "external",
        "summary": "CSCwd74134",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwd74134"
      },
      {
        "category": "external",
        "summary": "CSCwd74135",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwd74135"
      },
      {
        "category": "external",
        "summary": "CSCwe18204",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwe18204"
      },
      {
        "category": "external",
        "summary": "CSCwd74132",
        "url": "https://bst.cisco.com/bugsearch/bug/CSCwd74132"
      },
      {
        "category": "external",
        "summary": "Cisco Secure Endpoint",
        "url": "https://console.amp.cisco.com/"
      },
      {
        "category": "external",
        "summary": "Meet Cisco Secure",
        "url": "https://www.cisco.com/c/en/us/products/security/secure-names.html"
      },
      {
        "category": "external",
        "summary": "fixed software releases",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisories",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      }
    ],
    "title": "ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023",
    "tracking": {
      "current_release_date": "2023-02-22T14:09:19+00:00",
      "generator": {
        "date": "2024-05-10T23:21:52+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-clamav-q8DThCy",
      "initial_release_date": "2023-02-15T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2023-02-15T15:53:37+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2023-02-15T20:14:36+00:00",
          "number": "1.1.0",
          "summary": "Changed date of ClamAV disclosure to February 15."
        },
        {
          "date": "2023-02-17T19:43:51+00:00",
          "number": "1.2.0",
          "summary": "Added two more fixed releases and availability dates for Secure Web Appliance."
        },
        {
          "date": "2023-02-21T14:26:24+00:00",
          "number": "1.3.0",
          "summary": "Clarified the vulnerability impacts based on platform. Updated the link to the ClamAV blog."
        },
        {
          "date": "2023-02-22T14:09:19+00:00",
          "number": "1.4.0",
          "summary": "Updated proof-of-concept information."
        }
      ],
      "status": "final",
      "version": "1.4.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Secure Web Appliance",
            "product": {
              "name": "Cisco Secure Web Appliance ",
              "product_id": "CSAFPID-189789"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Secure Endpoint",
            "product": {
              "name": "Cisco Secure Endpoint ",
              "product_id": "CSAFPID-221075"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Secure Endpoint Private Cloud Administration Portal",
            "product": {
              "name": "Cisco Secure Endpoint Private Cloud Administration Portal ",
              "product_id": "CSAFPID-292706"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20032",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd74135"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd74134"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd74133"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwe18204"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd74132"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-221075",
          "CSAFPID-292706",
          "CSAFPID-189789"
        ]
      },
      "release_date": "2023-02-15T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-221075",
            "CSAFPID-292706",
            "CSAFPID-189789"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-221075",
            "CSAFPID-292706",
            "CSAFPID-189789"
          ]
        }
      ],
      "title": "ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:*",
              "matchCriteriaId": "40572314-306A-4594-A279-216B8139B7A0",
              "versionEndExcluding": "1.20.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:*",
              "matchCriteriaId": "726A787E-E64F-4906-9BAE-4F79EB530F1F",
              "versionEndExcluding": "1.21.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "C4F63447-CA0E-43FC-8FF1-B4032D21E32A",
              "versionEndExcluding": "7.5.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "D0FC45E7-C4AB-4AC5-87AB-0ED1508CCFF3",
              "versionEndExcluding": "8.1.5",
              "versionStartIncluding": "8.0.1.21160",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "07BFC8FC-6CF0-49DA-B4ED-5B7936A4233E",
              "versionEndExcluding": "3.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2EFF7AB1-33C6-4627-9950-2F2E48BCCC7E",
              "versionEndExcluding": "12.5.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8361D69-981F-4F28-86F9-EFF202C9E537",
              "versionEndExcluding": "14.0.4-005",
              "versionStartIncluding": "14.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF6E494A-FCA7-4569-847D-2AA3C14C3E79",
              "versionEndExcluding": "14.5.1-013",
              "versionStartIncluding": "14.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:web_security_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD8B1F66-9FD3-4970-BDA3-26241B18B4AA",
              "versionEndExcluding": "15.0.0-254",
              "versionStartIncluding": "15.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDF08008-9C84-4075-8AB7-233209E4F3C0",
              "versionEndIncluding": "0.103.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "14FA7424-A3E5-4F46-83F8-E9767330F1CE",
              "versionEndIncluding": "0.105.1",
              "versionStartIncluding": "0.104.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:clamav:clamav:1.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "A381BD3C-88E0-41FD-91E6-26BCF78B84CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:clamav:clamav:1.0.0:rc:*:*:*:*:*:*",
              "matchCriteriaId": "88BE0B1C-4515-40EA-ADDD-A04BF50743DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:clamav:clamav:1.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "FB00FEFE-F8A2-482D-A7EE-002DA4E10FF6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "88CF061E-FFD8-48DE-887F-2119C916E2B4",
              "versionEndExcluding": "3.7.35",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F499B698-4EB6-4262-BAF4-9BDE7F114805",
              "versionEndExcluding": "3.11.23",
              "versionStartIncluding": "3.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "40519377-ECDC-41E2-B6A6-7F601AC28ACD",
              "versionEndExcluding": "4.3.17",
              "versionStartIncluding": "4.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "77BAC9BA-B215-490F-9202-617B1B4E7C8A",
              "versionEndExcluding": "4.6.4",
              "versionStartIncluding": "4.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"]."
    }
  ],
  "id": "CVE-2023-20032",
  "lastModified": "2024-11-21T07:40:23.950",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-03-01T08:15:11.907",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202302-1452",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "web security appliance",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.5.0"
      },
      {
        "model": "web security appliance",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.0.0"
      },
      {
        "model": "clamav",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "clamav",
        "version": "0.103.7"
      },
      {
        "model": "secure endpoint",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "8.0.1.21160"
      },
      {
        "model": "network security",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "stormshield",
        "version": "4.6.4"
      },
      {
        "model": "network security",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "stormshield",
        "version": "3.7.35"
      },
      {
        "model": "web security appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.5.1-013"
      },
      {
        "model": "network security",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "stormshield",
        "version": "3.8.0"
      },
      {
        "model": "web security appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.5.6"
      },
      {
        "model": "network security",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "stormshield",
        "version": "4.4.0"
      },
      {
        "model": "network security",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "stormshield",
        "version": "3.11.23"
      },
      {
        "model": "network security",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "stormshield",
        "version": "4.3.0"
      },
      {
        "model": "clamav",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "clamav",
        "version": "0.105.1"
      },
      {
        "model": "web security appliance",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.0.0"
      },
      {
        "model": "network security",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "stormshield",
        "version": "3.0.0"
      },
      {
        "model": "web security appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.0.4-005"
      },
      {
        "model": "web security appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.0.0-254"
      },
      {
        "model": "clamav",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "clamav",
        "version": "1.0.0"
      },
      {
        "model": "secure endpoint",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.20.2"
      },
      {
        "model": "secure endpoint",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "8.1.5"
      },
      {
        "model": "clamav",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "clamav",
        "version": "0.104.0"
      },
      {
        "model": "secure endpoint",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.21.1"
      },
      {
        "model": "network security",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "stormshield",
        "version": "4.3.17"
      },
      {
        "model": "secure endpoint",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "7.5.9"
      },
      {
        "model": "secure endpoint private cloud",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.6.0"
      },
      {
        "model": "cisco web \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9 \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "clamav",
        "scope": null,
        "trust": 0.8,
        "vendor": "clamav",
        "version": null
      },
      {
        "model": "network security",
        "scope": null,
        "trust": 0.8,
        "vendor": "stormshield",
        "version": null
      },
      {
        "model": "cisco secure endpoint private cloud",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "cisco secure endpoint",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20032"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Ubuntu",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "171129"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2023-20032",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2023-20032",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2023-20032",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2023-20032",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "ykramarz@cisco.com",
            "id": "CVE-2023-20032",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2023-20032",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202302-1351",
            "trust": 0.6,
            "value": "CRITICAL"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202302-1351"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20032"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20032"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. \r\n\r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. \r\n\r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"]. Cisco Systems Cisco Secure Endpoint Products from other vendors have out-of-bounds write vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. \nThis advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy. ==========================================================================\nUbuntu Security Notice USN-5887-1\nFebruary 27, 2023\n\nclamav vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 22.10\n- Ubuntu 22.04 LTS\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 ESM\n- Ubuntu 14.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in ClamAV. \n\nSoftware Description:\n- clamav: Anti-virus utility for Unix\n\nDetails:\n\nSimon Scannell discovered that ClamAV incorrectly handled parsing\nHFS+ files. (CVE-2023-20032)\n\nSimon Scannell discovered that ClamAV incorrectly handled parsing\nDMG files. A remote attacker could possibly use this issue\nto expose sensitive information. (CVE-2023-20052)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 22.10:\n   clamav                          0.103.8+dfsg-0ubuntu0.22.10.1\n\nUbuntu 22.04 LTS:\n   clamav                          0.103.8+dfsg-0ubuntu0.22.04.1\n\nUbuntu 20.04 LTS:\n   clamav                          0.103.8+dfsg-0ubuntu0.20.04.1\n\nUbuntu 18.04 LTS:\n   clamav                          0.103.8+dfsg-0ubuntu0.18.04.1\n\nUbuntu 16.04 ESM:\n   clamav 0.103.8+dfsg-0ubuntu0.16.04.1+esm1\n\nUbuntu 14.04 ESM:\n   clamav 0.103.8+dfsg-0ubuntu0.14.04.1+esm1\n\nThis update uses a new upstream release, which includes additional bug\nfixes. In general, a standard system update will make all the necessary\nchanges. \n\nReferences:\n   https://ubuntu.com/security/notices/USN-5887-1\n   CVE-2023-20032, CVE-2023-20052\n\nPackage Information:\nhttps://launchpad.net/ubuntu/+source/clamav/0.103.8+dfsg-0ubuntu0.22.10.1\nhttps://launchpad.net/ubuntu/+source/clamav/0.103.8+dfsg-0ubuntu0.22.04.1\nhttps://launchpad.net/ubuntu/+source/clamav/0.103.8+dfsg-0ubuntu0.20.04.1\nhttps://launchpad.net/ubuntu/+source/clamav/0.103.8+dfsg-0ubuntu0.18.04.1\n\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 202310-01\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: ClamAV: Multiple Vulnerabilities\n     Date: October 01, 2023\n     Bugs: #831083, #842813, #894672\n       ID: 202310-01\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been discovered in ClamAV, the worst of\nwhich could result in remote code execution. \n\nBackground\n==========\n\nClamAV is a GPL virus scanner. \n\nAffected packages\n=================\n\nPackage               Vulnerable    Unaffected\n--------------------  ------------  ------------\napp-antivirus/clamav  \u003c 0.103.7     \u003e= 0.103.7\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in ClamAV. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll ClamAV users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=app-antivirus/clamav-0.103.7\"\n\nReferences\n==========\n\n[ 1 ] CVE-2022-20698\n      https://nvd.nist.gov/vuln/detail/CVE-2022-20698\n[ 2 ] CVE-2022-20770\n      https://nvd.nist.gov/vuln/detail/CVE-2022-20770\n[ 3 ] CVE-2022-20771\n      https://nvd.nist.gov/vuln/detail/CVE-2022-20771\n[ 4 ] CVE-2022-20785\n      https://nvd.nist.gov/vuln/detail/CVE-2022-20785\n[ 5 ] CVE-2022-20792\n      https://nvd.nist.gov/vuln/detail/CVE-2022-20792\n[ 6 ] CVE-2022-20796\n      https://nvd.nist.gov/vuln/detail/CVE-2022-20796\n[ 7 ] CVE-2022-20803\n      https://nvd.nist.gov/vuln/detail/CVE-2022-20803\n[ 8 ] CVE-2023-20032\n      https://nvd.nist.gov/vuln/detail/CVE-2023-20032\n[ 9 ] CVE-2023-20052\n      https://nvd.nist.gov/vuln/detail/CVE-2023-20052\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202310-01\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2023 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-20032"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-20032"
      },
      {
        "db": "PACKETSTORM",
        "id": "171129"
      },
      {
        "db": "PACKETSTORM",
        "id": "174873"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2023-20032",
        "trust": 3.5
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2023.0953",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2023.1077",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202302-1351",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-20032",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "171129",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "174873",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20032"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "db": "PACKETSTORM",
        "id": "171129"
      },
      {
        "db": "PACKETSTORM",
        "id": "174873"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202302-1351"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20032"
      }
    ]
  },
  "id": "VAR-202302-1452",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.45906568
  },
  "last_update_date": "2024-08-14T14:02:40.351000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "cisco-sa-clamav-q8DThCy",
        "trust": 0.8,
        "url": "https://www.clamav.net/"
      },
      {
        "title": "ClamAV Buffer error vulnerability fix",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=228436"
      },
      {
        "title": "Debian CVElist Bug Report Logs: clamav: 2 RCE bugs in ClamAV 0.103 (+ 1.0.0), CVE-2023-20032/CVE-2023-20052",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=72b1e54f904f4b9ca82d85ff39559617"
      },
      {
        "title": "Cisco: ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-clamav-q8DThCy"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/marekbeckmann/Clamav-Installation-Script "
      },
      {
        "title": null,
        "trust": 0.1,
        "url": "https://www.theregister.co.uk/2023/02/17/cisco_clamav_critical_flaw/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20032"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202302-1351"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-120",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-787",
        "trust": 1.0
      },
      {
        "problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20032"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-clamav-q8dthcy"
      },
      {
        "trust": 1.0,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2023-20032"
      },
      {
        "trust": 0.9,
        "url": "https://security.gentoo.org/glsa/202310-01"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2023-20032/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2023.0953"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2023.1077"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2023-20052"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/marekbeckmann/clamav-installation-script"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1031509"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/clamav/0.103.8+dfsg-0ubuntu0.22.10.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/clamav/0.103.8+dfsg-0ubuntu0.18.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-5887-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/clamav/0.103.8+dfsg-0ubuntu0.22.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/clamav/0.103.8+dfsg-0ubuntu0.20.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-20796"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-20792"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-20785"
      },
      {
        "trust": 0.1,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-20803"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-20771"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-20770"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-20698"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20032"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "db": "PACKETSTORM",
        "id": "171129"
      },
      {
        "db": "PACKETSTORM",
        "id": "174873"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202302-1351"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20032"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20032"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "db": "PACKETSTORM",
        "id": "171129"
      },
      {
        "db": "PACKETSTORM",
        "id": "174873"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202302-1351"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20032"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-11-06T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "date": "2023-02-27T14:51:49",
        "db": "PACKETSTORM",
        "id": "171129"
      },
      {
        "date": "2023-10-02T15:09:41",
        "db": "PACKETSTORM",
        "id": "174873"
      },
      {
        "date": "2023-02-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202302-1351"
      },
      {
        "date": "2023-03-01T08:15:11.907000",
        "db": "NVD",
        "id": "CVE-2023-20032"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-11-06T01:15:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      },
      {
        "date": "2023-03-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202302-1351"
      },
      {
        "date": "2024-01-25T17:15:25.840000",
        "db": "NVD",
        "id": "CVE-2023-20032"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "171129"
      },
      {
        "db": "PACKETSTORM",
        "id": "174873"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202302-1351"
      }
    ],
    "trust": 0.8
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco Systems \u00a0Cisco\u00a0Secure\u00a0Endpoint\u00a0 Out-of-Bounds Write Vulnerability in Other Vendors\u0027 Products",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-004930"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202302-1351"
      }
    ],
    "trust": 0.6
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for clamav",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for clamav fixes the following issues:\n\n- CVE-2023-20032: Fixed a possible remote code execution vulnerability in the HFS+ file parser (bsc#1208363).\n- CVE-2023-20052: Fixed a possible remote information leak vulnerability in the DMG file parser (bsc#1208365).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-471,SUSE-SLE-SERVER-12-SP5-2023-471",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_0471-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:0471-1",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20230471-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:0471-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013848.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208363",
        "url": "https://bugzilla.suse.com/1208363"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208365",
        "url": "https://bugzilla.suse.com/1208365"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20032 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20032/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20052 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20052/"
      }
    ],
    "title": "Security update for clamav",
    "tracking": {
      "current_release_date": "2023-02-21T09:07:10Z",
      "generator": {
        "date": "2023-02-21T09:07:10Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:0471-1",
      "initial_release_date": "2023-02-21T09:07:10Z",
      "revision_history": [
        {
          "date": "2023-02-21T09:07:10Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-3.24.1.aarch64",
                "product": {
                  "name": "clamav-0.103.8-3.24.1.aarch64",
                  "product_id": "clamav-0.103.8-3.24.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-3.24.1.i586",
                "product": {
                  "name": "clamav-0.103.8-3.24.1.i586",
                  "product_id": "clamav-0.103.8-3.24.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-3.24.1.ppc64le",
                "product": {
                  "name": "clamav-0.103.8-3.24.1.ppc64le",
                  "product_id": "clamav-0.103.8-3.24.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-3.24.1.s390",
                "product": {
                  "name": "clamav-0.103.8-3.24.1.s390",
                  "product_id": "clamav-0.103.8-3.24.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-3.24.1.s390x",
                "product": {
                  "name": "clamav-0.103.8-3.24.1.s390x",
                  "product_id": "clamav-0.103.8-3.24.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-3.24.1.x86_64",
                "product": {
                  "name": "clamav-0.103.8-3.24.1.x86_64",
                  "product_id": "clamav-0.103.8-3.24.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-3.24.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-3.24.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-3.24.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-3.24.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-3.24.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.s390x"
        },
        "product_reference": "clamav-0.103.8-3.24.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-3.24.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-3.24.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-3.24.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-3.24.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-3.24.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-3.24.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-3.24.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.s390x"
        },
        "product_reference": "clamav-0.103.8-3.24.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-3.24.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-3.24.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20032",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20032"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"].",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20032",
          "url": "https://www.suse.com/security/cve/CVE-2023-20032"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208363 for CVE-2023-20032",
          "url": "https://bugzilla.suse.com/1208363"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211720 for CVE-2023-20032",
          "url": "https://bugzilla.suse.com/1211720"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-21T09:07:10Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2023-20032"
    },
    {
      "cve": "CVE-2023-20052",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20052"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device.\r\n\r \r This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20052",
          "url": "https://www.suse.com/security/cve/CVE-2023-20052"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208365 for CVE-2023-20052",
          "url": "https://bugzilla.suse.com/1208365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:clamav-0.103.8-3.24.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.8-3.24.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-21T09:07:10Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-20052"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for clamav",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for clamav fixes the following issues:\n\n- CVE-2023-20032: Fixed a possible remote code execution vulnerability in the HFS+ file parser (bsc#1208363).\n- CVE-2023-20052: Fixed a possible remote information leak vulnerability in the DMG file parser (bsc#1208365).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-453,SUSE-OpenStack-Cloud-9-2023-453,SUSE-OpenStack-Cloud-Crowbar-9-2023-453,SUSE-SLE-SAP-12-SP4-2023-453,SUSE-SLE-SERVER-12-SP2-BCL-2023-453,SUSE-SLE-SERVER-12-SP4-LTSS-2023-453",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_0453-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:0453-1",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20230453-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:0453-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013839.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208363",
        "url": "https://bugzilla.suse.com/1208363"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208365",
        "url": "https://bugzilla.suse.com/1208365"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20032 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20032/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20052 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20052/"
      }
    ],
    "title": "Security update for clamav",
    "tracking": {
      "current_release_date": "2023-02-20T11:05:33Z",
      "generator": {
        "date": "2023-02-20T11:05:33Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:0453-1",
      "initial_release_date": "2023-02-20T11:05:33Z",
      "revision_history": [
        {
          "date": "2023-02-20T11:05:33Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-33.53.1.aarch64",
                "product": {
                  "name": "clamav-0.103.8-33.53.1.aarch64",
                  "product_id": "clamav-0.103.8-33.53.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-33.53.1.i586",
                "product": {
                  "name": "clamav-0.103.8-33.53.1.i586",
                  "product_id": "clamav-0.103.8-33.53.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-33.53.1.ppc64le",
                "product": {
                  "name": "clamav-0.103.8-33.53.1.ppc64le",
                  "product_id": "clamav-0.103.8-33.53.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-33.53.1.s390",
                "product": {
                  "name": "clamav-0.103.8-33.53.1.s390",
                  "product_id": "clamav-0.103.8-33.53.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-33.53.1.s390x",
                "product": {
                  "name": "clamav-0.103.8-33.53.1.s390x",
                  "product_id": "clamav-0.103.8-33.53.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-33.53.1.x86_64",
                "product": {
                  "name": "clamav-0.103.8-33.53.1.x86_64",
                  "product_id": "clamav-0.103.8-33.53.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud 9",
                "product": {
                  "name": "SUSE OpenStack Cloud 9",
                  "product_id": "SUSE OpenStack Cloud 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud:9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud Crowbar 9",
                "product": {
                  "name": "SUSE OpenStack Cloud Crowbar 9",
                  "product_id": "SUSE OpenStack Cloud Crowbar 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-bcl:12:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-33.53.1.x86_64 as component of SUSE OpenStack Cloud 9",
          "product_id": "SUSE OpenStack Cloud 9:clamav-0.103.8-33.53.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-33.53.1.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-33.53.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9",
          "product_id": "SUSE OpenStack Cloud Crowbar 9:clamav-0.103.8-33.53.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-33.53.1.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-33.53.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-33.53.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-33.53.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-33.53.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-33.53.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
          "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:clamav-0.103.8-33.53.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-33.53.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-33.53.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-33.53.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-33.53.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-33.53.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-33.53.1.s390x as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.s390x"
        },
        "product_reference": "clamav-0.103.8-33.53.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-33.53.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-33.53.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20032",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20032"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"].",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP2-BCL:clamav-0.103.8-33.53.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.s390x",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.x86_64",
          "SUSE OpenStack Cloud 9:clamav-0.103.8-33.53.1.x86_64",
          "SUSE OpenStack Cloud Crowbar 9:clamav-0.103.8-33.53.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20032",
          "url": "https://www.suse.com/security/cve/CVE-2023-20032"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208363 for CVE-2023-20032",
          "url": "https://bugzilla.suse.com/1208363"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211720 for CVE-2023-20032",
          "url": "https://bugzilla.suse.com/1211720"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:clamav-0.103.8-33.53.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.s390x",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.x86_64",
            "SUSE OpenStack Cloud 9:clamav-0.103.8-33.53.1.x86_64",
            "SUSE OpenStack Cloud Crowbar 9:clamav-0.103.8-33.53.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:clamav-0.103.8-33.53.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.s390x",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.x86_64",
            "SUSE OpenStack Cloud 9:clamav-0.103.8-33.53.1.x86_64",
            "SUSE OpenStack Cloud Crowbar 9:clamav-0.103.8-33.53.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-20T11:05:33Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2023-20032"
    },
    {
      "cve": "CVE-2023-20052",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20052"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device.\r\n\r \r This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP2-BCL:clamav-0.103.8-33.53.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.s390x",
          "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.x86_64",
          "SUSE OpenStack Cloud 9:clamav-0.103.8-33.53.1.x86_64",
          "SUSE OpenStack Cloud Crowbar 9:clamav-0.103.8-33.53.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20052",
          "url": "https://www.suse.com/security/cve/CVE-2023-20052"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208365 for CVE-2023-20052",
          "url": "https://bugzilla.suse.com/1208365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:clamav-0.103.8-33.53.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.s390x",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.x86_64",
            "SUSE OpenStack Cloud 9:clamav-0.103.8-33.53.1.x86_64",
            "SUSE OpenStack Cloud Crowbar 9:clamav-0.103.8-33.53.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP2-BCL:clamav-0.103.8-33.53.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.s390x",
            "SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1.x86_64",
            "SUSE OpenStack Cloud 9:clamav-0.103.8-33.53.1.x86_64",
            "SUSE OpenStack Cloud Crowbar 9:clamav-0.103.8-33.53.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-20T11:05:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-20052"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for clamav",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for clamav fixes the following issues:\n\n- CVE-2023-20032: Fixed a possible remote code execution vulnerability in the HFS+ file parser (bsc#1208363).\n- CVE-2023-20052: Fixed a possible remote information leak vulnerability in the DMG file parser (bsc#1208365).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-470,SUSE-SLE-Module-Basesystem-15-SP4-2023-470,SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-470,SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-470,SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-470,SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-470,SUSE-SLE-Product-RT-15-SP3-2023-470,SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-470,SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-470,SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-470,SUSE-SLE-Product-SLES_SAP-15-SP1-2023-470,SUSE-SLE-Product-SLES_SAP-15-SP2-2023-470,SUSE-SLE-Product-SLES_SAP-15-SP3-2023-470,SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-470,SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-470,SUSE-Storage-7-2023-470,SUSE-Storage-7.1-2023-470,openSUSE-SLE-15.4-2023-470",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_0470-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:0470-1",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20230470-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:0470-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013849.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208363",
        "url": "https://bugzilla.suse.com/1208363"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208365",
        "url": "https://bugzilla.suse.com/1208365"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20032 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20032/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20052 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20052/"
      }
    ],
    "title": "Security update for clamav",
    "tracking": {
      "current_release_date": "2023-02-21T09:06:01Z",
      "generator": {
        "date": "2023-02-21T09:06:01Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:0470-1",
      "initial_release_date": "2023-02-21T09:06:01Z",
      "revision_history": [
        {
          "date": "2023-02-21T09:06:01Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-150000.3.44.1.aarch64",
                "product": {
                  "name": "clamav-0.103.8-150000.3.44.1.aarch64",
                  "product_id": "clamav-0.103.8-150000.3.44.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
                "product": {
                  "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
                  "product_id": "clamav-devel-0.103.8-150000.3.44.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libclamav9-0.103.8-150000.3.44.1.aarch64",
                "product": {
                  "name": "libclamav9-0.103.8-150000.3.44.1.aarch64",
                  "product_id": "libclamav9-0.103.8-150000.3.44.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
                "product": {
                  "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
                  "product_id": "libfreshclam2-0.103.8-150000.3.44.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-150000.3.44.1.i586",
                "product": {
                  "name": "clamav-0.103.8-150000.3.44.1.i586",
                  "product_id": "clamav-0.103.8-150000.3.44.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-devel-0.103.8-150000.3.44.1.i586",
                "product": {
                  "name": "clamav-devel-0.103.8-150000.3.44.1.i586",
                  "product_id": "clamav-devel-0.103.8-150000.3.44.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libclamav9-0.103.8-150000.3.44.1.i586",
                "product": {
                  "name": "libclamav9-0.103.8-150000.3.44.1.i586",
                  "product_id": "libclamav9-0.103.8-150000.3.44.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libfreshclam2-0.103.8-150000.3.44.1.i586",
                "product": {
                  "name": "libfreshclam2-0.103.8-150000.3.44.1.i586",
                  "product_id": "libfreshclam2-0.103.8-150000.3.44.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-150000.3.44.1.ppc64le",
                "product": {
                  "name": "clamav-0.103.8-150000.3.44.1.ppc64le",
                  "product_id": "clamav-0.103.8-150000.3.44.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
                "product": {
                  "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
                  "product_id": "clamav-devel-0.103.8-150000.3.44.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
                "product": {
                  "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
                  "product_id": "libclamav9-0.103.8-150000.3.44.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
                "product": {
                  "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
                  "product_id": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-150000.3.44.1.s390x",
                "product": {
                  "name": "clamav-0.103.8-150000.3.44.1.s390x",
                  "product_id": "clamav-0.103.8-150000.3.44.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-devel-0.103.8-150000.3.44.1.s390x",
                "product": {
                  "name": "clamav-devel-0.103.8-150000.3.44.1.s390x",
                  "product_id": "clamav-devel-0.103.8-150000.3.44.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libclamav9-0.103.8-150000.3.44.1.s390x",
                "product": {
                  "name": "libclamav9-0.103.8-150000.3.44.1.s390x",
                  "product_id": "libclamav9-0.103.8-150000.3.44.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libfreshclam2-0.103.8-150000.3.44.1.s390x",
                "product": {
                  "name": "libfreshclam2-0.103.8-150000.3.44.1.s390x",
                  "product_id": "libfreshclam2-0.103.8-150000.3.44.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-150000.3.44.1.x86_64",
                "product": {
                  "name": "clamav-0.103.8-150000.3.44.1.x86_64",
                  "product_id": "clamav-0.103.8-150000.3.44.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
                "product": {
                  "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
                  "product_id": "clamav-devel-0.103.8-150000.3.44.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libclamav9-0.103.8-150000.3.44.1.x86_64",
                "product": {
                  "name": "libclamav9-0.103.8-150000.3.44.1.x86_64",
                  "product_id": "libclamav9-0.103.8-150000.3.44.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
                "product": {
                  "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
                  "product_id": "libfreshclam2-0.103.8-150000.3.44.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Real Time 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Real Time 15 SP3",
                  "product_id": "SUSE Linux Enterprise Real Time 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_rt:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Proxy 4.2",
                "product": {
                  "name": "SUSE Manager Proxy 4.2",
                  "product_id": "SUSE Manager Proxy 4.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-proxy:4.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Manager Server 4.2",
                "product": {
                  "name": "SUSE Manager Server 4.2",
                  "product_id": "SUSE Manager Server 4.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-manager-server:4.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 7",
                "product": {
                  "name": "SUSE Enterprise Storage 7",
                  "product_id": "SUSE Enterprise Storage 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Enterprise Storage 7.1",
                "product": {
                  "name": "SUSE Enterprise Storage 7.1",
                  "product_id": "SUSE Enterprise Storage 7.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:ses:7.1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4",
                "product": {
                  "name": "openSUSE Leap 15.4",
                  "product_id": "openSUSE Leap 15.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Real Time 15 SP3",
          "product_id": "SUSE Linux Enterprise Real Time 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Real Time 15 SP3",
          "product_id": "SUSE Linux Enterprise Real Time 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Real Time 15 SP3",
          "product_id": "SUSE Linux Enterprise Real Time 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Real Time 15 SP3",
          "product_id": "SUSE Linux Enterprise Real Time 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.s390x as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Manager Proxy 4.2",
          "product_id": "SUSE Manager Proxy 4.2:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Manager Proxy 4.2",
          "product_id": "SUSE Manager Proxy 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Manager Proxy 4.2",
          "product_id": "SUSE Manager Proxy 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Manager Proxy 4.2",
          "product_id": "SUSE Manager Proxy 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Proxy 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.ppc64le as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.s390x as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.s390x as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.s390x as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.s390x as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Manager Server 4.2",
          "product_id": "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Server 4.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Enterprise Storage 7",
          "product_id": "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of SUSE Enterprise Storage 7.1",
          "product_id": "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "SUSE Enterprise Storage 7.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-150000.3.44.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-150000.3.44.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-150000.3.44.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.s390x"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-150000.3.44.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-150000.3.44.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20032",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20032"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"].",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Proxy 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Proxy 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Proxy 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Proxy 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.aarch64",
          "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.ppc64le",
          "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.s390x",
          "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.x86_64",
          "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.s390x",
          "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20032",
          "url": "https://www.suse.com/security/cve/CVE-2023-20032"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208363 for CVE-2023-20032",
          "url": "https://bugzilla.suse.com/1208363"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211720 for CVE-2023-20032",
          "url": "https://bugzilla.suse.com/1211720"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-21T09:06:01Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2023-20032"
    },
    {
      "cve": "CVE-2023-20052",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20052"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device.\r\n\r \r This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Real Time 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Proxy 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Proxy 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Proxy 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Proxy 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.s390x",
          "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.s390x",
          "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
          "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.aarch64",
          "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.ppc64le",
          "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.s390x",
          "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.x86_64",
          "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
          "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
          "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.s390x",
          "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
          "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.aarch64",
          "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
          "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.s390x",
          "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.x86_64",
          "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
          "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
          "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
          "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20052",
          "url": "https://www.suse.com/security/cve/CVE-2023-20052"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208365 for CVE-2023-20052",
          "url": "https://bugzilla.suse.com/1208365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7.1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Enterprise Storage 7:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP4:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Real Time 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP1-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP2-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Linux Enterprise Server 15 SP3-LTSS:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP1:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP3:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Proxy 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:clamav-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "SUSE Manager Server 4.2:libfreshclam2-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:clamav-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:clamav-devel-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:libclamav9-0.103.8-150000.3.44.1.x86_64",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.aarch64",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.ppc64le",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.s390x",
            "openSUSE Leap 15.4:libfreshclam2-0.103.8-150000.3.44.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-02-21T09:06:01Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-20052"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "ABB",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "En",
    "notes": [
      {
        "category": "summary",
        "text": "ABB is aware of public reports of a vulnerabilities in product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could cause the product to stop, make the product inacces-sible, take remote control of the product or insert and run arbitrary code.\nAs part of ABB product lifecycle policy, once a product transitions to end-of-life, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document, such as using a private APN cellular network between Arctic wireless gateways and ARM600 for establishing VPN tunnels, to mitigate security risks and avoid potential vulnerabilities.\nAs part of ABB product lifecycle policy, once a product transitions to Limited state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document to mitigate security risks.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n3.\tARM600 system is by default not dependent on the name service (DNS). If name service is not used in the system, the name service port (TCP/UDP port 53) can be blocked by a firewall.\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n5.\tFilter specific ICMP packets from external systems (ICMP type 13 and 14) by firewall for not exposing the system time. \n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n\n14.\tIn ARM600SW installations, avoid servers with AMD processors vulnerable to the following: CVE-2021-26401, CVE-2023-20569 and CVE-2023-20593.\n\n\n15.\tAvoid using AX88179_178A chipset-based USB -to-Ethernet devices.\n\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
        "title": "Mitigating factors"
      },
      {
        "category": "other",
        "text": "For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:\n\u2013\tIsolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).\n\u2013\tInstall physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.\n\u2013\tNever connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.\n\u2013\tScan all data imported into your environment before use to detect potential malware infections.\n\u2013\tMinimize network exposure for all applications and endpoints to ensure that they are not accessible from the internet unless they are designed for such exposure and the intended use requires such.\n\u2013\tEnsure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.\n\u2013\tWhen remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\nMore information on recommended practices can be found in the following document:\n1MRS758860 Rev. F, Arctic Cyber Security Deployment Guideline\n",
        "title": "General security recommendations"
      },
      {
        "category": "other",
        "text": "For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.\nInformation about ABB\u2019s cyber security program and capabilities can be found at www.abb.com/cybersecurity.\n",
        "title": "Support"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.\nABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.\nThis document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.\nAll rights to registrations and trademarks reside with their respective owners.\n",
        "title": "Notice"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from ABB PSIRT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Energy",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Switzerland",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-25-105-08 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-105-08.json"
      },
      {
        "summary": "User Manual",
        "url": "https://library.e.abb.com/public/0498e4c0babd46aa9243aedd6f99c375/ARM600_user_758861_ENk.pdf"
      },
      {
        "summary": "ABB product lifecycle policy",
        "url": "https://new.abb.com/service/electrification/life-cycle-management?pe_data=D42415F457244415145784545584371%7C29609824"
      },
      {
        "summary": "ABB CYBERSECURITY ADVISORY - PDF version ",
        "url": "https://search.abb.com/library/Download.aspx?DocumentID=2NGA002579\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
      },
      {
        "summary": "1MRS758860, Rev. F Arctic, Cyber Security Deployment Guideline",
        "url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS758860\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
      },
      {
        "summary": "Cyber Security Deployment Guideline",
        "url": "https://library.e.abb.com/public/ffab1a14a42646c6adee38fc3de61dad/Arctic_csdepl_758860_ENf.pdf"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-25-105-08 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ABB M2M Gateway",
    "tracking": {
      "current_release_date": "2025-04-07T10:30:00.000000Z",
      "generator": {
        "date": "2025-04-15T16:37:24.772764Z",
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-25-105-08",
      "initial_release_date": "2025-04-07T10:30:00.000000Z",
      "revision_history": [
        {
          "date": "2025-04-07T10:30:00.000000Z",
          "number": "1.0.0",
          "summary": "Initial Version"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003e=4.1.2|\u003c=5.0.3",
                    "product": {
                      "name": "ABB M2M Gateway ARM600, firmware versions = 4.1.2 \u003c= 5.0.3",
                      "product_id": "CSAFPID-0001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "ARM600"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003e=5.0.1|\u003c=5.0.3",
                    "product": {
                      "name": "ABB M2M Gateway SW, software versions = 5.0.1 \u003c= 5.0.3",
                      "product_id": "CSAFPID-0002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "SW"
              }
            ],
            "category": "product_family",
            "name": "ABB M2M Gateway"
          }
        ],
        "category": "vendor",
        "name": "ABB"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-23521",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in Git that arises from an issue with git attributes parsing. This flaw can lead to an integer overflow, which might be exploited by authenticated attackers to execute arbitrary code or cause a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-23521",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23521"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-23521"
    },
    {
      "cve": "CVE-2022-41903",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in Git that involves a heap overflow in the git archive and git log --format commands. This flaw can potentially lead to remote code execution (RCE) if exploited by authenticated attacker.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-41903",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41903"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-41903"
    },
    {
      "cve": "CVE-2023-25690",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in Apache HTTP Server versions 2.4.0 through 2.4.55. It involves HTTP Request Smuggling\ndue to certain mod_proxy configurations combined with RewriteRule or ProxyPassMatch directives. This\nflaw can lead to bypassing access controls by an authenticated attacker.\n",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-25690",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25690"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-25690"
    },
    {
      "cve": "CVE-2023-38408",
      "cwe": {
        "id": "CWE-428",
        "name": "Unquoted Search Path or Element"
      },
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the PKCS#11 feature of ssh-agent in OpenSSH versions before 9.3p2. It involves an \ninsufficiently trustworthy search path, which can lead to remote code execution if an agent is \nforwarded by authenticated user to an attacker-controlled system.\n",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD -CVE-2023-38408 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38408"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-38408"
    },
    {
      "cve": "CVE-2016-10009",
      "cwe": {
        "id": "CWE-426",
        "name": "Untrusted Search Path"
      },
      "notes": [
        {
          "category": "description",
          "text": "Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote\nattackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent socket.\n",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2016-10009",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10009"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.8,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.8,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2016-10009"
    },
    {
      "cve": "CVE-2022-2526",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability was found in system. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in \u0027resolved-dns-stream.c\u0027 not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later, allowing authenticated user to execute arbitrary code.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-2526",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2526"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "REASONABLE",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-2526"
    },
    {
      "cve": "CVE-2022-37434",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field, potentially allowing an authenticated attacker to reveal sensitive information or to cause a denial-of-service situation.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-37434",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37434"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-37434"
    },
    {
      "cve": "CVE-2023-20032",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An authenticated attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-20032",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20032"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-20032"
    },
    {
      "cve": "CVE-2022-38177",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "notes": [
        {
          "category": "description",
          "text": "By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2022-38177",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38177"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "\nMitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n3.\tARM600 system is by default not dependent on the name service (DNS). If name service is not used in the system, the name service port (TCP/UDP port 53) can be blocked by a firewall.\n\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.9,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-38177"
    },
    {
      "cve": "CVE-2022-38178",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "notes": [
        {
          "category": "description",
          "text": "By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD -CVE-2022-38178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38178"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "\nMitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n3.\tARM600 system is by default not dependent on the name service (DNS). If name service is not used in the system, the name service port (TCP/UDP port 53) can be blocked by a firewall.\n\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.9,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-38178"
    },
    {
      "cve": "CVE-2023-2828",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "description",
          "text": "The vulnerability allows the configured max-cache-size limit to be significantly exceeded by querying the resolver for specific RRsets in a certain order. This can lead to a denial-of-service condition by ex-hausting all available memory on the host running named service.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2023-2828",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2828"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "\nMitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n3.\tARM600 system is by default not dependent on the name service (DNS). If name service is not used in the system, the name service port (TCP/UDP port 53) can be blocked by a firewall.\n\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-2828"
    },
    {
      "cve": "CVE-2023-3341",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "The vulnerability involves the recursive processing of control channel messages sent to named, which can exhaust stack memory and cause named to terminate unexpectedly. Exploiting this flaw requires only network access to the control channel\u0027s configured TCP port, without needing a valid RNDC key.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-3341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3341"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "\nMitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n3.\tARM600 system is by default not dependent on the name service (DNS). If name service is not used in the system, the name service port (TCP/UDP port 53) can be blocked by a firewall.\n\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.9,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-3341"
    },
    {
      "cve": "CVE-2022-41974",
      "cwe": {
        "id": "CWE-269",
        "name": "Improper Privilege Management"
      },
      "notes": [
        {
          "category": "description",
          "text": "Local users able to write to UNIX domain sockets can bypass access controls and manipulate the mul-tipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD -CVE-2022-41974",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41974"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-41974"
    },
    {
      "cve": "CVE-2022-40674",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "Local users can write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-40674",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40674"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.9,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-40674"
    },
    {
      "cve": "CVE-2023-25652",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "By feeding specially crafted input as authenticated attacker to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents, leading to potential arbitrary code execution.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2023-25652",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25652"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.9,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-25652"
    },
    {
      "cve": "CVE-2023-29007",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "A specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user\u0027s `$GIT_DIR/config` when attempting to remove the con-figuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution.",
          "title": "CVE Decsription"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2023-29007",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29007"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-29007"
    },
    {
      "cve": "CVE-2022-2964",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u2019s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-2964",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2964"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n\n15.\tAvoid using AX88179_178A chipset-based USB -to-Ethernet devices.\n\n\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.7,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-2964"
    },
    {
      "cve": "CVE-2021-26401",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "description",
          "text": "Flaw in certain AMD EPYC, Ryzen, Threadripper and Athlon processors considering LONGJMP assembly command. This could lead to arbitrary code execution. Note: ARM600 servers include Intel processors, but there may be ARM600 SW installations running in AMD processor environments.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2021-26401",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26401"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n\n14.\tIn ARM600SW installations, avoid servers with AMD processors vulnerable to the following: CVE-2021-26401, CVE-2023-20569 and CVE-2023-20593.\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 5.2,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 5.2,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2021-26401"
    },
    {
      "cve": "CVE-2022-4378",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "notes": [
        {
          "category": "description",
          "text": "A stack overflow flaw was found in the Linux kernel\u0027s SYSCTL subsystem in how an authenticated user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2022-4378",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4378"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-4378"
    },
    {
      "cve": "CVE-2022-42703",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double re-use. This could lead to a system crash or elevation of privileges.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-42703",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42703"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 4.1,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 4.1,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-42703"
    },
    {
      "cve": "CVE-2022-3564",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. This could cause leaking of data or Denial of Service (DoS) conditions.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - cve-2022-3564",
          "url": "https://nvd.nist.gov/vuln/detail/cve-2022-3564"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.3,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-3564"
    },
    {
      "cve": "CVE-2023-32233",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. This could lead to an unprivileged local user gaining root access.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-32233",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32233"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-32233"
    },
    {
      "cve": "CVE-2023-35001",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace. This vulnerability could lead to local user privilege escalation.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-35001",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35001"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-35001"
    },
    {
      "cve": "CVE-2023-3609",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability in the Linux kernel\u0027s net/sched: cls_u32 component can be exploited to achieve local user privilege escalation.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-3609",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3609"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-3609"
    },
    {
      "cve": "CVE-2023-42753",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "A missing netfilter macro could lead to a miscalculation of the `h-\u003enets` array offset, providing attack-ers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bounds. This vulnerability may allow a local user to crash the system or potentially escalate their privileges.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-42753",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42753"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-42753"
    },
    {
      "cve": "CVE-2022-42898",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "PAC parsing in krb5 has integer overflows that may lead to denial of service.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - cve-2022-42898",
          "url": "https://nvd.nist.gov/vuln/detail/cve-2022-42898"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.3,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.3,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-42898"
    },
    {
      "cve": "CVE-2020-22218",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "An issue was discovered in function _libssh2_packet_add in libssh2 that allows attackers to access out of bounds memory. This could lead to a system crash by authenticated attacker.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2020-22218",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22218"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2020-22218"
    },
    {
      "cve": "CVE-2023-0286",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE.  When CRL checking is enabled, this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2023-0286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0286"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 5.9,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-0286"
    },
    {
      "cve": "CVE-2023-24329",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "An issue in the urllib.parse component of Python allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Successful exploitation of this vulnerability could lead to addition or modification of data by an authenticated attacker.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-24329",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24329"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-24329"
    },
    {
      "cve": "CVE-2022-29154",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "Remote arbitrary files write inside the directories of connecting peers. A malicious rsync server can overwrite arbitrary files in the rsync client target directory and subdirectories.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2022-29154",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29154"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.3,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-29154"
    },
    {
      "cve": "CVE-2023-22809",
      "cwe": {
        "id": "CWE-269",
        "name": "Improper Privilege Management"
      },
      "notes": [
        {
          "category": "description",
          "text": "The sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This could lead to privilege escalation.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-22809",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22809"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.2,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.2,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-22809"
    },
    {
      "cve": "CVE-2022-25147",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "Apache portable runtime utility issue may allow a malicious attacker to cause an out-of-bounds write due to an integer overflow when encoding/decoding a very long string using the base64 family of functions. This could lead to modification of data or denial of service.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-25147",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25147"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-25147"
    },
    {
      "cve": "CVE-2021-25220",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "When using forwarders, bogus NS records supplied by, or via, those forwarders may be cached and used by named if it needs to recurse for any reason, causing it to obtain and pass on potentially incor-rect answers. This could cause DNS cache poisoning that could potentially lead to a denial of service and information disclosure by an authenticated attacker.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2021-25220",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25220"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "\nMitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n3.\tARM600 system is by default not dependent on the name service (DNS). If name service is not used in the system, the name service port (TCP/UDP port 53) can be blocked by a firewall.\n\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 6.3,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 6.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2021-25220"
    },
    {
      "cve": "CVE-2022-2795",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "description",
          "text": "Processing large delegations may severely degrade resolver performance effectively denying legitimate clients access to the DNS resolution service. This could cause a denial-of-service conditions.",
          "title": "CVE Descritpion"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2022-2795",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2795"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "\nMitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n3.\tARM600 system is by default not dependent on the name service (DNS). If name service is not used in the system, the name service port (TCP/UDP port 53) can be blocked by a firewall.\n\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "environmentalScore": 2.5,
            "environmentalSeverity": "LOW",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 2.5,
            "temporalSeverity": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-2795"
    },
    {
      "cve": "CVE-2022-43750",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel allows a user-space client to corrupt the monitor\u0027s internal memory. This could lead to denial-of-service or information disclosure conditions by an authenticated attacker.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2022-43750",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43750"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.2,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.2,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2022-43750"
    },
    {
      "cve": "CVE-2023-20569",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "description",
          "text": "Return Address Predictor vulnerability leading to information disclosure in certain AMD processors. This may result in speculative execution at an attacker-controlled\u202faddress, potentially leading to information disclosure. Note: ARM600 servers utilize Intel processors, but there may be ARM600 SW installations running in AMD processor environments.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2023-20569",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20569"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n\n14.\tIn ARM600SW installations, avoid servers with AMD processors vulnerable to the following: CVE-2021-26401, CVE-2023-20569 and CVE-2023-20593.\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 4.3,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 4.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-20569"
    },
    {
      "cve": "CVE-2023-20593",
      "cwe": {
        "id": "CWE-209",
        "name": "Generation of Error Message Containing Sensitive Information"
      },
      "notes": [
        {
          "category": "description",
          "text": "Cross-Process Information Leak in certain AMD processors. This could lead to an attacker potentially accessing confidential information. Note: ARM600 servers utilize Intel processors, but there may be ARM600 SW installations running in AMD processor environments.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2023-20593",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20593"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 5.1,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.1,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-20593"
    },
    {
      "cve": "CVE-2023-40217",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "description",
          "text": "If a TLS server side socket is created, receives data, and then closes quickly, there\u0027s a brief window where the SSLSocket instance detects it as \"not connected\" and won\u0027t initiate a handshake. Buffered data remains readable but unauthenticated if client certificate authentication is expected. This data is limited to the buffer size. An unauthenticated attacker could exploit this vulnerability for revealing sensitive information from the server.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2023-40217",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40217"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 4.9,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 4.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-40217"
    },
    {
      "cve": "CVE-2023-48795",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "notes": [
        {
          "category": "description",
          "text": "Remote attackers may bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2023-48795",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48795"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.4,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.4,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-48795"
    },
    {
      "cve": "CVE-2013-0169",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "description",
          "text": "TLS protocol version 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2 do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the \"Lucky Thirteen\" issue.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD- CVE-2013-0169",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0169"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 6,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2013-0169"
    },
    {
      "cve": "CVE-2012-4929",
      "cwe": {
        "id": "CWE-212",
        "name": "Improper Removal of Sensitive Information Before Storage or Transfer"
      },
      "notes": [
        {
          "category": "description",
          "text": "The TLS protocol 1.2 and earlier can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a \"CRIME\" attack.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD-CVE-2012-4929",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4929"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n1.\tObtain a cellular private access point (APN). A dedicated private cellular access point and respective SIM card subscriptions can be requested from your cellular service provider. This service doesn\u2019t expose the traffic between remote sites and main site to the internet but rather uses cellular operator\u2019s private wide area network (WAN). Therefore, the ARM600 wouldn\u2019t need open ports to the internet.\n\n2.\tAvoid exposing any system component to the internet. If, however, the ARM600 is exposed to the internet, only the VPN port should be opened towards the internet (e.g., Patrol management connections can be configured to use VPN tunnel and remote administration connections can be implemented by using OpenVPN PC-client).\n\n4.\tPerform firewall configuration by the \"allowlisting\" principle, i.e., explicitly allowing only the required ports and protocols and blocking any other traffic.\n\n\n6.\tIf the internet is used as a WAN media for carrying VPN tunnels, use Demilitarized Zone (DMZ) for terminating connections from the internet (i.e., the remote connections should terminate to the DMZ network, which would be segregated from other networks by a firewall. The ARM600 server would be located into this DMZ).\n\n7.\tChange the default user credentials of ARM600 and Arctic wireless gateways into non-defaults and use complex non-guessable passwords with special characters. Do not reuse passwords within the system.\n\n\n8.\tUse administrator (i.e., root user) privileges only when required by the task.\n\n\n9.\tSupporting systems, such as PCs used for configuration, should be frequently updated. If possible, use dedicated site PCs for upgrading and engineering purposes. At minimum, PCs should be investigated by running a full virus scan with recently updated signature files before introducing the PC to the OT system. \n\nAny data, such as device configurations and firmware update files transferred to the Arctic system should be virus scanned prior to transferring.\n\n\n10.\tIntroduce a backup policy, which will ensure periodical backups and backup revision numbering. Consider the following:\na.\tCheck that the entire system has backups available from all applicable parts.\nb.\tStore the backups in a safe place (e.g. in an encrypted storage), restricted by role-based access control mechanisms.\nc.\tEnsure the security of the configuration PCs that may have local copies of device configurations.\nd.\tValidate the backups to make sure that they\u2019re working.\n\n\n11.\tFollow cyber security best practices for installation, operation, and decommissioning as described in the product\u2019s Cyber Security Deployment Guideline and User Manual.\n\n\n12.\tUse continuous monitoring (e.g., intrusion detection/prevention tools) to detect anomalies in the system\n\n\n13.\tConsider hardening the system according to the following:\na.\tRemove any unnecessary communication links in the system.\nb.\tIf possible, close unused physical ports.\nc.\tOpen only the necessary TCP/UDP ports in the configuration.\nd.\tRemove all unnecessary user accounts.\ne.\tRestrict traffic by firewall.\nf.\tAllow the traffic only from/to necessary hosts\u0027 IP addresses (i.e., define both source and destination in the firewall rules, where possible).\ng.\tDefine client IP address as allowed address in SCADA communication protocols, if such configuration is supported.\nh.\tRemove or deactivate all unused processes, communication ports and services, where possible.\ni.\tUse physical access controls to the system installations (e.g., to server rooms and device cabinets). \n\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "environmentalScore": 3.4,
            "environmentalSeverity": "LOW",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 3.4,
            "temporalSeverity": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2012-4929"
    },
    {
      "cve": "CVE-1999-0524",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "description",
          "text": "The \u201cICMP Timestamp Request Remote Date Disclosure\u201d vulnerability involves the use of ICMP (internet Control Message Protocol) to request and receive timestamp information from a target system.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-1999-0524",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-1999-0524"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "\nMitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. The following mitigations are recommended.\n\n5.\tFilter specific ICMP packets from external systems (ICMP type 13 and 14) by firewall for not exposing the system time.\n\nRefer to section General security recommendations for additional advice on how to keep your system secure.\n",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "FUNCTIONAL",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "TEMPORARY_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:T/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-1999-0524"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "clamav-0.103.8-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the clamav-0.103.8-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-12696",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12696-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20032 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20032/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-20052 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-20052/"
      }
    ],
    "title": "clamav-0.103.8-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:12696-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-1.1.aarch64",
                "product": {
                  "name": "clamav-0.103.8-1.1.aarch64",
                  "product_id": "clamav-0.103.8-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-devel-0.103.8-1.1.aarch64",
                "product": {
                  "name": "clamav-devel-0.103.8-1.1.aarch64",
                  "product_id": "clamav-devel-0.103.8-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-docs-html-0.103.8-1.1.aarch64",
                "product": {
                  "name": "clamav-docs-html-0.103.8-1.1.aarch64",
                  "product_id": "clamav-docs-html-0.103.8-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-milter-0.103.8-1.1.aarch64",
                "product": {
                  "name": "clamav-milter-0.103.8-1.1.aarch64",
                  "product_id": "clamav-milter-0.103.8-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libclamav9-0.103.8-1.1.aarch64",
                "product": {
                  "name": "libclamav9-0.103.8-1.1.aarch64",
                  "product_id": "libclamav9-0.103.8-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libfreshclam2-0.103.8-1.1.aarch64",
                "product": {
                  "name": "libfreshclam2-0.103.8-1.1.aarch64",
                  "product_id": "libfreshclam2-0.103.8-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-1.1.ppc64le",
                "product": {
                  "name": "clamav-0.103.8-1.1.ppc64le",
                  "product_id": "clamav-0.103.8-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-devel-0.103.8-1.1.ppc64le",
                "product": {
                  "name": "clamav-devel-0.103.8-1.1.ppc64le",
                  "product_id": "clamav-devel-0.103.8-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-docs-html-0.103.8-1.1.ppc64le",
                "product": {
                  "name": "clamav-docs-html-0.103.8-1.1.ppc64le",
                  "product_id": "clamav-docs-html-0.103.8-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-milter-0.103.8-1.1.ppc64le",
                "product": {
                  "name": "clamav-milter-0.103.8-1.1.ppc64le",
                  "product_id": "clamav-milter-0.103.8-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libclamav9-0.103.8-1.1.ppc64le",
                "product": {
                  "name": "libclamav9-0.103.8-1.1.ppc64le",
                  "product_id": "libclamav9-0.103.8-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libfreshclam2-0.103.8-1.1.ppc64le",
                "product": {
                  "name": "libfreshclam2-0.103.8-1.1.ppc64le",
                  "product_id": "libfreshclam2-0.103.8-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-1.1.s390x",
                "product": {
                  "name": "clamav-0.103.8-1.1.s390x",
                  "product_id": "clamav-0.103.8-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-devel-0.103.8-1.1.s390x",
                "product": {
                  "name": "clamav-devel-0.103.8-1.1.s390x",
                  "product_id": "clamav-devel-0.103.8-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-docs-html-0.103.8-1.1.s390x",
                "product": {
                  "name": "clamav-docs-html-0.103.8-1.1.s390x",
                  "product_id": "clamav-docs-html-0.103.8-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-milter-0.103.8-1.1.s390x",
                "product": {
                  "name": "clamav-milter-0.103.8-1.1.s390x",
                  "product_id": "clamav-milter-0.103.8-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libclamav9-0.103.8-1.1.s390x",
                "product": {
                  "name": "libclamav9-0.103.8-1.1.s390x",
                  "product_id": "libclamav9-0.103.8-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libfreshclam2-0.103.8-1.1.s390x",
                "product": {
                  "name": "libfreshclam2-0.103.8-1.1.s390x",
                  "product_id": "libfreshclam2-0.103.8-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "clamav-0.103.8-1.1.x86_64",
                "product": {
                  "name": "clamav-0.103.8-1.1.x86_64",
                  "product_id": "clamav-0.103.8-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-devel-0.103.8-1.1.x86_64",
                "product": {
                  "name": "clamav-devel-0.103.8-1.1.x86_64",
                  "product_id": "clamav-devel-0.103.8-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-docs-html-0.103.8-1.1.x86_64",
                "product": {
                  "name": "clamav-docs-html-0.103.8-1.1.x86_64",
                  "product_id": "clamav-docs-html-0.103.8-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "clamav-milter-0.103.8-1.1.x86_64",
                "product": {
                  "name": "clamav-milter-0.103.8-1.1.x86_64",
                  "product_id": "clamav-milter-0.103.8-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libclamav9-0.103.8-1.1.x86_64",
                "product": {
                  "name": "libclamav9-0.103.8-1.1.x86_64",
                  "product_id": "libclamav9-0.103.8-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libfreshclam2-0.103.8-1.1.x86_64",
                "product": {
                  "name": "libfreshclam2-0.103.8-1.1.x86_64",
                  "product_id": "libfreshclam2-0.103.8-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-0.103.8-1.1.aarch64"
        },
        "product_reference": "clamav-0.103.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-0.103.8-1.1.ppc64le"
        },
        "product_reference": "clamav-0.103.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-0.103.8-1.1.s390x"
        },
        "product_reference": "clamav-0.103.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-0.103.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-0.103.8-1.1.x86_64"
        },
        "product_reference": "clamav-0.103.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.aarch64"
        },
        "product_reference": "clamav-devel-0.103.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.ppc64le"
        },
        "product_reference": "clamav-devel-0.103.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.s390x"
        },
        "product_reference": "clamav-devel-0.103.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-devel-0.103.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.x86_64"
        },
        "product_reference": "clamav-devel-0.103.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-docs-html-0.103.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.aarch64"
        },
        "product_reference": "clamav-docs-html-0.103.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-docs-html-0.103.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.ppc64le"
        },
        "product_reference": "clamav-docs-html-0.103.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-docs-html-0.103.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.s390x"
        },
        "product_reference": "clamav-docs-html-0.103.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-docs-html-0.103.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.x86_64"
        },
        "product_reference": "clamav-docs-html-0.103.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-milter-0.103.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.aarch64"
        },
        "product_reference": "clamav-milter-0.103.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-milter-0.103.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.ppc64le"
        },
        "product_reference": "clamav-milter-0.103.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-milter-0.103.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.s390x"
        },
        "product_reference": "clamav-milter-0.103.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clamav-milter-0.103.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.x86_64"
        },
        "product_reference": "clamav-milter-0.103.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.aarch64"
        },
        "product_reference": "libclamav9-0.103.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.ppc64le"
        },
        "product_reference": "libclamav9-0.103.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.s390x"
        },
        "product_reference": "libclamav9-0.103.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libclamav9-0.103.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.x86_64"
        },
        "product_reference": "libclamav9-0.103.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.aarch64"
        },
        "product_reference": "libfreshclam2-0.103.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.ppc64le"
        },
        "product_reference": "libfreshclam2-0.103.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.s390x"
        },
        "product_reference": "libfreshclam2-0.103.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreshclam2-0.103.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.x86_64"
        },
        "product_reference": "libfreshclam2-0.103.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20032",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20032"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"].",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:clamav-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:clamav-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:clamav-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:clamav-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20032",
          "url": "https://www.suse.com/security/cve/CVE-2023-20032"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208363 for CVE-2023-20032",
          "url": "https://bugzilla.suse.com/1208363"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211720 for CVE-2023-20032",
          "url": "https://bugzilla.suse.com/1211720"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2023-20032"
    },
    {
      "cve": "CVE-2023-20052",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-20052"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device.\r\n\r \r This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:clamav-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:clamav-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:clamav-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:clamav-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.x86_64",
          "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.aarch64",
          "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.ppc64le",
          "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.s390x",
          "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-20052",
          "url": "https://www.suse.com/security/cve/CVE-2023-20052"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208365 for CVE-2023-20052",
          "url": "https://bugzilla.suse.com/1208365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-devel-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:clamav-milter-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:libclamav9-0.103.8-1.1.x86_64",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.aarch64",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.ppc64le",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.s390x",
            "openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-20052"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2023-20032",
    "id": "GSD-2023-20032",
    "references": [
      "https://alas.aws.amazon.com/cve/html/CVE-2023-20032.html",
      "https://advisories.mageia.org/CVE-2023-20032.html",
      "https://www.suse.com/security/cve/CVE-2023-20032.html",
      "https://ubuntu.com/security/CVE-2023-20032"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-20032"
      ],
      "details": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"].",
      "id": "GSD-2023-20032",
      "modified": "2023-12-13T01:20:28.590497Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@cisco.com",
        "ID": "CVE-2023-20032",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Cisco Secure Web Appliance",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "11.7.0-406"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.7.0-418"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.7.1-049"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.7.1-006"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.7.1-020"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.7.2-011"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.8.0-414"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.8.1-023"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.8.3-018"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.8.3-021"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0.1-268"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0.3-007"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5.2-007"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5.1-011"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5.4-005"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5.5-004"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.5.0-498"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.0.3-014"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.0.2-012"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Cisco Secure Endpoint",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "6.1.9"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "6.2.5"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "6.3.7"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "6.3.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.0.5"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.1.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.12.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.12.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.12.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.12.7"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.12.4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.11.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.10.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.10.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.14.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.6.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.9.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.8.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.8.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "1.7.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.2.13"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.3.5"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Cisco Secure Endpoint Private Cloud Administration Portal",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "N/A"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Cisco"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"]."
          }
        ]
      },
      "exploit": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is aware that a proof-of-concept is available that demonstrates that this vulnerability can be used to cause a buffer overflow and subsequent process termination.\r\n\r\nAdditional technical information is also available that describes this vulnerability in detail.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-120",
                "lang": "eng",
                "value": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy",
            "refsource": "MISC",
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy"
          }
        ]
      },
      "source": {
        "advisory": "cisco-sa-clamav-q8DThCy",
        "defects": [
          "CSCwd74135",
          "CSCwd74134",
          "CSCwd74133",
          "CSCwe18204",
          "CSCwd74132"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:*",
                    "matchCriteriaId": "40572314-306A-4594-A279-216B8139B7A0",
                    "versionEndExcluding": "1.20.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:*",
                    "matchCriteriaId": "726A787E-E64F-4906-9BAE-4F79EB530F1F",
                    "versionEndExcluding": "1.21.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "C4F63447-CA0E-43FC-8FF1-B4032D21E32A",
                    "versionEndExcluding": "7.5.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*",
                    "matchCriteriaId": "D0FC45E7-C4AB-4AC5-87AB-0ED1508CCFF3",
                    "versionEndExcluding": "8.1.5",
                    "versionStartIncluding": "8.0.1.21160",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "07BFC8FC-6CF0-49DA-B4ED-5B7936A4233E",
                    "versionEndExcluding": "3.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:web_security_appliance:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2EFF7AB1-33C6-4627-9950-2F2E48BCCC7E",
                    "versionEndExcluding": "12.5.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:web_security_appliance:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A8361D69-981F-4F28-86F9-EFF202C9E537",
                    "versionEndExcluding": "14.0.4-005",
                    "versionStartIncluding": "14.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:web_security_appliance:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CF6E494A-FCA7-4569-847D-2AA3C14C3E79",
                    "versionEndExcluding": "14.5.1-013",
                    "versionStartIncluding": "14.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:web_security_appliance:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BD8B1F66-9FD3-4970-BDA3-26241B18B4AA",
                    "versionEndExcluding": "15.0.0-254",
                    "versionStartIncluding": "15.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BDF08008-9C84-4075-8AB7-233209E4F3C0",
                    "versionEndIncluding": "0.103.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "14FA7424-A3E5-4F46-83F8-E9767330F1CE",
                    "versionEndIncluding": "0.105.1",
                    "versionStartIncluding": "0.104.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:clamav:clamav:1.0.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "A381BD3C-88E0-41FD-91E6-26BCF78B84CA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:clamav:clamav:1.0.0:rc:*:*:*:*:*:*",
                    "matchCriteriaId": "88BE0B1C-4515-40EA-ADDD-A04BF50743DA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:clamav:clamav:1.0.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "FB00FEFE-F8A2-482D-A7EE-002DA4E10FF6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "88CF061E-FFD8-48DE-887F-2119C916E2B4",
                    "versionEndExcluding": "3.7.35",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F499B698-4EB6-4262-BAF4-9BDE7F114805",
                    "versionEndExcluding": "3.11.23",
                    "versionStartIncluding": "3.8.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "40519377-ECDC-41E2-B6A6-7F601AC28ACD",
                    "versionEndExcluding": "4.3.17",
                    "versionStartIncluding": "4.3.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "77BAC9BA-B215-490F-9202-617B1B4E7C8A",
                    "versionEndExcluding": "4.6.4",
                    "versionStartIncluding": "4.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:\r\n\r \r A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.\r\n\r \r This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.\r\n\r For a description of this vulnerability, see the ClamAV blog [\"https://blog.clamav.net/\"]."
          }
        ],
        "id": "CVE-2023-20032",
        "lastModified": "2024-01-25T17:15:25.840",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "ykramarz@cisco.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2023-03-01T08:15:11.907",
        "references": [
          {
            "source": "ykramarz@cisco.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy"
          }
        ],
        "sourceIdentifier": "ykramarz@cisco.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-120"
              }
            ],
            "source": "ykramarz@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}