cve-2024-47506
Vulnerability from cvelistv5
Published
2024-10-11 15:37
Modified
2024-10-11 17:15
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/R:A/RE:M
Summary
A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a large amount of traffic is processed by ATP Cloud inspection, a deadlock can occur which will result in a PFE crash and restart. Whether the crash occurs, depends on system internal timing that is outside the attackers control. This issue affects Junos OS on SRX Series: * All versions before 21.3R3-S1, * 21.4 versions before 21.4R3, * 22.1 versions before 22.1R2, * 22.2 versions before 22.2R1-S2, 22.2R2.
References
sirt@juniper.nethttps://supportportal.juniper.net/JSA88137
Impacted products
Vendor Product Version
Juniper Networks Junos OS Version: 0   ≤
Version: 21.4   ≤
Version: 22.1   ≤
Version: 22.2   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-47506",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-11T17:15:25.387504Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-11T17:15:46.190Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               platforms: [
                  "SRX Series",
               ],
               product: "Junos OS",
               vendor: "Juniper Networks",
               versions: [
                  {
                     lessThan: "21.3R3-S1",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "21.4R3",
                     status: "affected",
                     version: "21.4",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.1R2",
                     status: "affected",
                     version: "22.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.2R1-S2, 22.2R2",
                     status: "affected",
                     version: "22.2",
                     versionType: "semver",
                  },
               ],
            },
         ],
         configurations: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<span style=\"background-color: rgb(255, 255, 255);\">To be exposed to this issue a minimal configuration like the following needs to be present:<br><br></span><tt><span style=\"background-color: rgb(255, 255, 255);\">[&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">services advanced-anti-malware policy &lt;</span>aamw-policy-name&gt; ... ]<br>[ security policies from-zone &lt;source-zone&gt; to-zone &lt;destination-zone&gt; policy &lt;name&gt; then permit application-services advanced-anti-malware-policy &lt;</span>aamw-policy-name&gt; ]</tt>",
                  },
               ],
               value: "To be exposed to this issue a minimal configuration like the following needs to be present:\n\n[ services advanced-anti-malware policy <aamw-policy-name> ... ]\n[ security policies from-zone <source-zone> to-zone <destination-zone> policy <name> then permit application-services advanced-anti-malware-policy <aamw-policy-name> ]",
            },
         ],
         datePublic: "2024-10-09T16:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).<br><br>When a large amount of traffic is processed by ATP Cloud inspection, a deadlock can occur which will result in a PFE crash and restart. Whether the crash occurs, depends on system internal timing that is outside the attackers control.<br>\n\n<br><p>This issue affects Junos OS on SRX Series:</p><p></p><ul><li>All versions before 21.3R3-S1,</li><li>21.4 versions before 21.4R3,</li><li>22.1 versions before 22.1R2,</li><li>22.2 versions before 22.2R1-S2, 22.2R2.</li></ul><p></p>",
                  },
               ],
               value: "A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).\n\nWhen a large amount of traffic is processed by ATP Cloud inspection, a deadlock can occur which will result in a PFE crash and restart. Whether the crash occurs, depends on system internal timing that is outside the attackers control.\n\n\n\nThis issue affects Junos OS on SRX Series:\n\n\n\n  *  All versions before 21.3R3-S1,\n  *  21.4 versions before 21.4R3,\n  *  22.1 versions before 22.1R2,\n  *  22.2 versions before 22.2R1-S2, 22.2R2.",
            },
         ],
         exploits: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.",
                  },
               ],
               value: "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
            {
               cvssV4_0: {
                  Automatable: "NOT_DEFINED",
                  Recovery: "AUTOMATIC",
                  Safety: "NOT_DEFINED",
                  attackComplexity: "LOW",
                  attackRequirements: "PRESENT",
                  attackVector: "NETWORK",
                  baseScore: 8.2,
                  baseSeverity: "HIGH",
                  privilegesRequired: "NONE",
                  providerUrgency: "NOT_DEFINED",
                  subAvailabilityImpact: "LOW",
                  subConfidentialityImpact: "NONE",
                  subIntegrityImpact: "NONE",
                  userInteraction: "NONE",
                  valueDensity: "NOT_DEFINED",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/R:A/RE:M",
                  version: "4.0",
                  vulnAvailabilityImpact: "HIGH",
                  vulnConfidentialityImpact: "NONE",
                  vulnIntegrityImpact: "NONE",
                  vulnerabilityResponseEffort: "MODERATE",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-833",
                     description: "CWE-833 Deadlock",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-10-11T15:37:32.961Z",
            orgId: "8cbe9d5a-a066-4c94-8978-4b15efeae968",
            shortName: "juniper",
         },
         references: [
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://supportportal.juniper.net/JSA88137",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "The following software releases have been updated to resolve this specific issue: 21.3R3-S1, 21.4R3, 22.1R2, 22.2R1-S2, 22.2R2, 22.3R1, and all subsequent releases.",
                  },
               ],
               value: "The following software releases have been updated to resolve this specific issue: 21.3R3-S1, 21.4R3, 22.1R2, 22.2R1-S2, 22.2R2, 22.3R1, and all subsequent releases.",
            },
         ],
         source: {
            advisory: "JSA88137",
            defect: [
               "1661766",
            ],
            discovery: "USER",
         },
         title: "Junos OS: SRX Series: A large amount of traffic being processed by ATP Cloud can lead to a PFE crash",
         workarounds: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "There are no known workarounds for this issue.",
                  },
               ],
               value: "There are no known workarounds for this issue.",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8cbe9d5a-a066-4c94-8978-4b15efeae968",
      assignerShortName: "juniper",
      cveId: "CVE-2024-47506",
      datePublished: "2024-10-11T15:37:32.961Z",
      dateReserved: "2024-09-25T15:26:52.610Z",
      dateUpdated: "2024-10-11T17:15:46.190Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-47506\",\"sourceIdentifier\":\"sirt@juniper.net\",\"published\":\"2024-10-11T16:15:12.450\",\"lastModified\":\"2024-10-15T12:58:51.050\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).\\n\\nWhen a large amount of traffic is processed by ATP Cloud inspection, a deadlock can occur which will result in a PFE crash and restart. Whether the crash occurs, depends on system internal timing that is outside the attackers control.\\n\\n\\n\\nThis issue affects Junos OS on SRX Series:\\n\\n\\n\\n  *  All versions before 21.3R3-S1,\\n  *  21.4 versions before 21.4R3,\\n  *  22.1 versions before 22.1R2,\\n  *  22.2 versions before 22.2R1-S2, 22.2R2.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de bloqueo en el motor de reenvío de paquetes (PFE) de Juniper Networks Junos OS en SRX Series permite que un atacante no autenticado basado en la red provoque una denegación de servicio (DoS). Cuando la inspección de ATP Cloud procesa una gran cantidad de tráfico, puede producirse un bloqueo que provocará un bloqueo y reinicio del PFE. El hecho de que se produzca el bloqueo depende de la sincronización interna del sistema que está fuera del control del atacante. Este problema afecta a Junos OS en SRX Series: * Todas las versiones anteriores a 21.3R3-S1, * Versiones 21.4 anteriores a 21.4R3, * Versiones 22.1 anteriores a 22.1R2, * Versiones 22.2 anteriores a 22.2R1-S2, 22.2R2.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:M/U:X\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnerableSystemConfidentiality\":\"NONE\",\"vulnerableSystemIntegrity\":\"NONE\",\"vulnerableSystemAvailability\":\"HIGH\",\"subsequentSystemConfidentiality\":\"NONE\",\"subsequentSystemIntegrity\":\"NONE\",\"subsequentSystemAvailability\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NOT_DEFINED\",\"recovery\":\"AUTOMATIC\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-833\"}]}],\"references\":[{\"url\":\"https://supportportal.juniper.net/JSA88137\",\"source\":\"sirt@juniper.net\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47506\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-11T17:15:25.387504Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-11T17:15:35.947Z\"}}], \"cna\": {\"title\": \"Junos OS: SRX Series: A large amount of traffic being processed by ATP Cloud can lead to a PFE crash\", \"source\": {\"defect\": [\"1661766\"], \"advisory\": \"JSA88137\", \"discovery\": \"USER\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"AUTOMATIC\", \"baseScore\": 8.2, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/R:A/RE:M\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Juniper Networks\", \"product\": \"Junos OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"21.3R3-S1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"21.4\", \"lessThan\": \"21.4R3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.1\", \"lessThan\": \"22.1R2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.2\", \"lessThan\": \"22.2R1-S2, 22.2R2\", \"versionType\": \"semver\"}], \"platforms\": [\"SRX Series\"], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The following software releases have been updated to resolve this specific issue: 21.3R3-S1, 21.4R3, 22.1R2, 22.2R1-S2, 22.2R2, 22.3R1, and all subsequent releases.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The following software releases have been updated to resolve this specific issue: 21.3R3-S1, 21.4R3, 22.1R2, 22.2R1-S2, 22.2R2, 22.3R1, and all subsequent releases.\", \"base64\": false}]}], \"datePublic\": \"2024-10-09T16:00:00.000Z\", \"references\": [{\"url\": \"https://supportportal.juniper.net/JSA88137\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"There are no known workarounds for this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"There are no known workarounds for this issue.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).\\n\\nWhen a large amount of traffic is processed by ATP Cloud inspection, a deadlock can occur which will result in a PFE crash and restart. Whether the crash occurs, depends on system internal timing that is outside the attackers control.\\n\\n\\n\\nThis issue affects Junos OS on SRX Series:\\n\\n\\n\\n  *  All versions before 21.3R3-S1,\\n  *  21.4 versions before 21.4R3,\\n  *  22.1 versions before 22.1R2,\\n  *  22.2 versions before 22.2R1-S2, 22.2R2.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).<br><br>When a large amount of traffic is processed by ATP Cloud inspection, a deadlock can occur which will result in a PFE crash and restart. Whether the crash occurs, depends on system internal timing that is outside the attackers control.<br>\\n\\n<br><p>This issue affects Junos OS on SRX Series:</p><p></p><ul><li>All versions before 21.3R3-S1,</li><li>21.4 versions before 21.4R3,</li><li>22.1 versions before 22.1R2,</li><li>22.2 versions before 22.2R1-S2, 22.2R2.</li></ul><p></p>\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-833\", \"description\": \"CWE-833 Deadlock\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"To be exposed to this issue a minimal configuration like the following needs to be present:\\n\\n[\\u00a0services advanced-anti-malware policy <aamw-policy-name> ... ]\\n[ security policies from-zone <source-zone> to-zone <destination-zone> policy <name> then permit application-services advanced-anti-malware-policy <aamw-policy-name> ]\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<span style=\\\"background-color: rgb(255, 255, 255);\\\">To be exposed to this issue a minimal configuration like the following needs to be present:<br><br></span><tt><span style=\\\"background-color: rgb(255, 255, 255);\\\">[&nbsp;<span style=\\\"background-color: rgb(255, 255, 255);\\\">services advanced-anti-malware policy &lt;</span>aamw-policy-name&gt; ... ]<br>[ security policies from-zone &lt;source-zone&gt; to-zone &lt;destination-zone&gt; policy &lt;name&gt; then permit application-services advanced-anti-malware-policy &lt;</span>aamw-policy-name&gt; ]</tt>\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"shortName\": \"juniper\", \"dateUpdated\": \"2024-10-11T15:37:32.961Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-47506\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-11T17:15:46.190Z\", \"dateReserved\": \"2024-09-25T15:26:52.610Z\", \"assignerOrgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"datePublished\": \"2024-10-11T15:37:32.961Z\", \"assignerShortName\": \"juniper\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.