rhsa-2024_10178
Vulnerability from csaf_redhat
Published
2024-11-21 19:24
Modified
2024-12-06 14:55
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.0.6 Update

Notes

Topic
New Red Hat build of Keycloak 26.0.6 packages with security impact Important are available from the Customer Portal
Details
Red Hat build of Keycloak 26.0.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes: * Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451) * Keycloak Denial of Service (CVE-2024-10270) * Keycloak path trasversal (CVE-2024-10492) * Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666) * Keycloak TLS passthrough (CVE-2024-10039)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New Red Hat build of Keycloak 26.0.6 packages with security impact Important are available from the Customer Portal",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak 26.0.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nSecurity fixes:\n* Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)\n* Keycloak Denial of Service (CVE-2024-10270)\n* Keycloak path trasversal (CVE-2024-10492)\n* Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)\n* Keycloak TLS passthrough (CVE-2024-10039)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:10178",
        "url": "https://access.redhat.com/errata/RHSA-2024:10178"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2317440",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440"
      },
      {
        "category": "external",
        "summary": "2319217",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217"
      },
      {
        "category": "external",
        "summary": "2321214",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214"
      },
      {
        "category": "external",
        "summary": "2322096",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096"
      },
      {
        "category": "external",
        "summary": "2322447",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10178.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.0.6 Update",
    "tracking": {
      "current_release_date": "2024-12-06T14:55:56+00:00",
      "generator": {
        "date": "2024-12-06T14:55:56+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.2"
        }
      },
      "id": "RHSA-2024:10178",
      "initial_release_date": "2024-11-21T19:24:44+00:00",
      "revision_history": [
        {
          "date": "2024-11-21T19:24:44+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-11-21T19:24:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-06T14:55:56+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 26.0.6",
                "product": {
                  "name": "Red Hat build of Keycloak 26.0.6",
                  "product_id": "Red Hat build of Keycloak 26.0.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:26"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-9666",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2024-10-08T22:25:08.077000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2317440"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service.\nThe attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Application Server 8 does not ship the affected component and so is not affected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.0.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9666"
        },
        {
          "category": "external",
          "summary": "RHBZ#2317440",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9666",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9666"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666"
        }
      ],
      "release_date": "2024-11-21T16:45:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T19:24:44+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Keycloak 26.0.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10178"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.0.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Alexander Schwartz"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-10039",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2024-10-16T15:34:51.800000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2319217"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: mTLS passthrough",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Application Platform does not ship the Keycloak server code and thus is not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.0.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-10039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2319217",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-10039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039"
        }
      ],
      "release_date": "2024-11-21T16:45:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T19:24:44+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Keycloak 26.0.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10178"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.0.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-core: mTLS passthrough"
    },
    {
      "cve": "CVE-2024-10270",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2024-10-23T01:51:45.483000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2321214"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak:keycloak-services: Keycloak Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Application Platform 8 does not ship or provide the affected component, and so is not affected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.0.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-10270"
        },
        {
          "category": "external",
          "summary": "RHBZ#2321214",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10270",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-10270"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270"
        }
      ],
      "release_date": "2024-11-21T16:54:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T19:24:44+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Keycloak 26.0.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10178"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.0.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.keycloak:keycloak-services: Keycloak Denial of Service"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Steven Hawkins"
          ]
        }
      ],
      "cve": "CVE-2024-10451",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "discovery_date": "2024-10-28T07:27:41.800000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2322096"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Application Platform 8 does not ship the affected component and so is not affected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.0.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-10451"
        },
        {
          "category": "external",
          "summary": "RHBZ#2322096",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10451",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-10451"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451"
        }
      ],
      "release_date": "2024-11-21T16:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T19:24:44+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Keycloak 26.0.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10178"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Keycloak 26.0.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Brahim Raddahi"
          ],
          "organization": "is4u.be"
        }
      ],
      "cve": "CVE-2024-10492",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2024-10-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2322447"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-quarkus-server: Keycloak path trasversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability. This issue only affects the keycloak-quarkus-server, which is present on the Red Hat Build of Keycloak. No other products are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Keycloak 26.0.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-10492"
        },
        {
          "category": "external",
          "summary": "RHBZ#2322447",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10492",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-10492"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492"
        }
      ],
      "release_date": "2024-11-21T16:56:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-11-21T19:24:44+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Keycloak 26.0.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:10178"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat build of Keycloak 26.0.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak-quarkus-server: Keycloak path trasversal"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.