Vulnerability from csaf_suse
Published
2024-10-29 12:55
Modified
2024-10-29 12:55
Summary
Security update for pgadmin4

Notes

Title of the patch
Security update for pgadmin4
Description of the patch
This update for pgadmin4 fixes the following issues: - CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967) - CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248) - CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252) - CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423) - CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366) - CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295) - CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861) - CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684) - CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564) - CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)
Patchnames
SUSE-2024-3771,SUSE-SLE-Module-Python3-15-SP6-2024-3771,openSUSE-SLE-15.6-2024-3771
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for pgadmin4",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for pgadmin4 fixes the following issues:\n\n- CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)\n- CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)\n- CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)\n- CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)\n- CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)\n- CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)\n- CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)\n- CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)\n- CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)\n- CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2024-3771,SUSE-SLE-Module-Python3-15-SP6-2024-3771,openSUSE-SLE-15.6-2024-3771",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_3771-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2024:3771-1",
            url: "https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2024:3771-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2024-October/019689.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1224295",
            url: "https://bugzilla.suse.com/1224295",
         },
         {
            category: "self",
            summary: "SUSE Bug 1224366",
            url: "https://bugzilla.suse.com/1224366",
         },
         {
            category: "self",
            summary: "SUSE Bug 1226967",
            url: "https://bugzilla.suse.com/1226967",
         },
         {
            category: "self",
            summary: "SUSE Bug 1227248",
            url: "https://bugzilla.suse.com/1227248",
         },
         {
            category: "self",
            summary: "SUSE Bug 1227252",
            url: "https://bugzilla.suse.com/1227252",
         },
         {
            category: "self",
            summary: "SUSE Bug 1229423",
            url: "https://bugzilla.suse.com/1229423",
         },
         {
            category: "self",
            summary: "SUSE Bug 1229861",
            url: "https://bugzilla.suse.com/1229861",
         },
         {
            category: "self",
            summary: "SUSE Bug 1230928",
            url: "https://bugzilla.suse.com/1230928",
         },
         {
            category: "self",
            summary: "SUSE Bug 1231564",
            url: "https://bugzilla.suse.com/1231564",
         },
         {
            category: "self",
            summary: "SUSE Bug 1231684",
            url: "https://bugzilla.suse.com/1231684",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-38355 page",
            url: "https://www.suse.com/security/cve/CVE-2024-38355/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-38998 page",
            url: "https://www.suse.com/security/cve/CVE-2024-38998/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-38999 page",
            url: "https://www.suse.com/security/cve/CVE-2024-38999/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-39338 page",
            url: "https://www.suse.com/security/cve/CVE-2024-39338/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-4067 page",
            url: "https://www.suse.com/security/cve/CVE-2024-4067/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-4068 page",
            url: "https://www.suse.com/security/cve/CVE-2024-4068/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-43788 page",
            url: "https://www.suse.com/security/cve/CVE-2024-43788/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-48948 page",
            url: "https://www.suse.com/security/cve/CVE-2024-48948/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-48949 page",
            url: "https://www.suse.com/security/cve/CVE-2024-48949/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-9014 page",
            url: "https://www.suse.com/security/cve/CVE-2024-9014/",
         },
      ],
      title: "Security update for pgadmin4",
      tracking: {
         current_release_date: "2024-10-29T12:55:34Z",
         generator: {
            date: "2024-10-29T12:55:34Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2024:3771-1",
         initial_release_date: "2024-10-29T12:55:34Z",
         revision_history: [
            {
               date: "2024-10-29T12:55:34Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "pgadmin4-8.5-150600.3.6.1.noarch",
                        product: {
                           name: "pgadmin4-8.5-150600.3.6.1.noarch",
                           product_id: "pgadmin4-8.5-150600.3.6.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                        product: {
                           name: "pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                           product_id: "pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                        product: {
                           name: "pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                           product_id: "pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "pgadmin4-doc-8.5-150600.3.6.1.noarch",
                        product: {
                           name: "pgadmin4-doc-8.5-150600.3.6.1.noarch",
                           product_id: "pgadmin4-doc-8.5-150600.3.6.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                        product: {
                           name: "pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                           product_id: "pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "system-user-pgadmin-8.5-150600.3.6.1.noarch",
                        product: {
                           name: "system-user-pgadmin-8.5-150600.3.6.1.noarch",
                           product_id: "system-user-pgadmin-8.5-150600.3.6.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Python 3 15 SP6",
                        product: {
                           name: "SUSE Linux Enterprise Module for Python 3 15 SP6",
                           product_id: "SUSE Linux Enterprise Module for Python 3 15 SP6",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-python3:15:sp6",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.6",
                        product: {
                           name: "openSUSE Leap 15.6",
                           product_id: "openSUSE Leap 15.6",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.6",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "pgadmin4-8.5-150600.3.6.1.noarch as component of SUSE Linux Enterprise Module for Python 3 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
            },
            product_reference: "pgadmin4-8.5-150600.3.6.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Python 3 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "pgadmin4-doc-8.5-150600.3.6.1.noarch as component of SUSE Linux Enterprise Module for Python 3 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
            },
            product_reference: "pgadmin4-doc-8.5-150600.3.6.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Python 3 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "system-user-pgadmin-8.5-150600.3.6.1.noarch as component of SUSE Linux Enterprise Module for Python 3 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            },
            product_reference: "system-user-pgadmin-8.5-150600.3.6.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Python 3 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "pgadmin4-8.5-150600.3.6.1.noarch as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
            },
            product_reference: "pgadmin4-8.5-150600.3.6.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "pgadmin4-cloud-8.5-150600.3.6.1.noarch as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
            },
            product_reference: "pgadmin4-cloud-8.5-150600.3.6.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "pgadmin4-desktop-8.5-150600.3.6.1.noarch as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
            },
            product_reference: "pgadmin4-desktop-8.5-150600.3.6.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "pgadmin4-doc-8.5-150600.3.6.1.noarch as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
            },
            product_reference: "pgadmin4-doc-8.5-150600.3.6.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
            },
            product_reference: "pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "system-user-pgadmin-8.5-150600.3.6.1.noarch as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            },
            product_reference: "system-user-pgadmin-8.5-150600.3.6.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-38355",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-38355",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.\n",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-38355",
               url: "https://www.suse.com/security/cve/CVE-2024-38355",
            },
            {
               category: "external",
               summary: "SUSE Bug 1226965 for CVE-2024-38355",
               url: "https://bugzilla.suse.com/1226965",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "important",
            },
         ],
         title: "CVE-2024-38355",
      },
      {
         cve: "CVE-2024-38998",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-38998",
            },
         ],
         notes: [
            {
               category: "general",
               text: "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-38998",
               url: "https://www.suse.com/security/cve/CVE-2024-38998",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227247 for CVE-2024-38998",
               url: "https://bugzilla.suse.com/1227247",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.6,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "important",
            },
         ],
         title: "CVE-2024-38998",
      },
      {
         cve: "CVE-2024-38999",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-38999",
            },
         ],
         notes: [
            {
               category: "general",
               text: "jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-38999",
               url: "https://www.suse.com/security/cve/CVE-2024-38999",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227251 for CVE-2024-38999",
               url: "https://bugzilla.suse.com/1227251",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.6,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "important",
            },
         ],
         title: "CVE-2024-38999",
      },
      {
         cve: "CVE-2024-39338",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-39338",
            },
         ],
         notes: [
            {
               category: "general",
               text: "axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-39338",
               url: "https://www.suse.com/security/cve/CVE-2024-39338",
            },
            {
               category: "external",
               summary: "SUSE Bug 1229421 for CVE-2024-39338",
               url: "https://bugzilla.suse.com/1229421",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "critical",
            },
         ],
         title: "CVE-2024-39338",
      },
      {
         cve: "CVE-2024-4067",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-4067",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-4067",
               url: "https://www.suse.com/security/cve/CVE-2024-4067",
            },
            {
               category: "external",
               summary: "SUSE Bug 1224255 for CVE-2024-4067",
               url: "https://bugzilla.suse.com/1224255",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "important",
            },
         ],
         title: "CVE-2024-4067",
      },
      {
         cve: "CVE-2024-4068",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-4068",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-4068",
               url: "https://www.suse.com/security/cve/CVE-2024-4068",
            },
            {
               category: "external",
               summary: "SUSE Bug 1224256 for CVE-2024-4068",
               url: "https://bugzilla.suse.com/1224256",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "important",
            },
         ],
         title: "CVE-2024-4068",
      },
      {
         cve: "CVE-2024-43788",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-43788",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack's `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-43788",
               url: "https://www.suse.com/security/cve/CVE-2024-43788",
            },
            {
               category: "external",
               summary: "SUSE Bug 1229860 for CVE-2024-43788",
               url: "https://bugzilla.suse.com/1229860",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-43788",
      },
      {
         cve: "CVE-2024-48948",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-48948",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-48948",
               url: "https://www.suse.com/security/cve/CVE-2024-48948",
            },
            {
               category: "external",
               summary: "SUSE Bug 1231681 for CVE-2024-48948",
               url: "https://bugzilla.suse.com/1231681",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-48948",
      },
      {
         cve: "CVE-2024-48949",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-48949",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits \"sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()\" validation.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-48949",
               url: "https://www.suse.com/security/cve/CVE-2024-48949",
            },
            {
               category: "external",
               summary: "SUSE Bug 1231557 for CVE-2024-48949",
               url: "https://bugzilla.suse.com/1231557",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.2,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "important",
            },
         ],
         title: "CVE-2024-48949",
      },
      {
         cve: "CVE-2024-9014",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-9014",
            },
         ],
         notes: [
            {
               category: "general",
               text: "pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
               "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-9014",
               url: "https://www.suse.com/security/cve/CVE-2024-9014",
            },
            {
               category: "external",
               summary: "SUSE Bug 1230928 for CVE-2024-9014",
               url: "https://bugzilla.suse.com/1230928",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1.noarch",
                  "openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-10-29T12:55:34Z",
               details: "important",
            },
         ],
         title: "CVE-2024-9014",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.