suse-su-2025:20717-1
Vulnerability from csaf_suse
Published
2025-09-16 07:50
Modified
2025-09-16 07:50
Summary
Security update for rust-keylime

Notes

Title of the patch
Security update for rust-keylime
Description of the patch
This update for rust-keylime fixes the following issues: - Update vendored crate slab to version 0.4.11 * CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function leading to undefined behavior or potential crash due to out-of-bounds access (bsc#1248006) - Update to version 0.2.8+12: * build(deps): bump actions/checkout from 4 to 5 * build(deps): bump cfg-if from 1.0.0 to 1.0.1 * build(deps): bump openssl from 0.10.72 to 0.10.73 * build(deps): bump clap from 4.5.39 to 4.5.45 * build(deps): bump pest from 2.8.0 to 2.8.1 * Fix clippy warnings * Use verifier-provided interval for continuous attestation timing * Add meta object with seconds_to_next_attestation to evidence response * Fix boot time retrieval * Fix IMA log format (it must be ['text/plain']) (#1073) * Remove unnecessary configuration fields * cargo: Bump retry-policies to version 0.4.0 - Update vendored crate shlex to version 1.3.0 * CVE-2024-58266: Fixed command injection (bsc#1247193) - Update to version 0.2.7+141: * service: Use WantedBy=multi-user.target * rpm: Add subpackage for push-attestation agent * push-model: implement continuous attestation with configurable intervals * Retry registration forever in the state machine * Add Verifier URL to configuration * Align exp.backoff to current configuration format * Increase coverage of state machine (using Context) * Increase coverage of struct_filler.rs * Groom code (remove dead code) * Fix exponential backoff (10secs, 4xx accepted) * test: Add documentation test to tests/run.sh * tpm: Avoid running code example during documentation tests * state_machine: Always start the agent from the Unregistered state * Add fixes for the URL construction * Refactor evidences collection in push attestation agent * push-model: refactor attestation logic into a state machine * Fix body sending by allowing serializing strings (#1057) * Log ResilientClient errors/response status codes (#1055) * Add AK signing scheme and hash algorithm to negotiation * tpm: Add method to extract signing scheme and hash algorithm from AK * Allow custom content-type/accept headers * Integrate exponential backoff to registration (#1052) * keylime/structures: Rename ShaValues to PcrBanks * Add resilient_client for exponential backoff (#1048) - Update vendored crate openssl 0.10.73: * CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch (bsc#1242623) - Update to version 0.2.7+117: * Increase coverage in evidence handling structure * Add Capabilities Negotiations resp. missing fields * Fix UEFI test to check file access in all cases * context_info_handler: Do not assume /var/lib/keylime exists * Fix clippy warnings about uninlined format arguments * attestation: Allow unwrap() in tests * Increase coverage (groom code, extend unit tests) * Include IMA/UEFI logs in Evidence Handling request * Include method to get all IMA entries as string * Send correct list of pcr banks and sign algorithms * Try to fix TPM tests related issues * Define attestation perform asynchronous * Perform attestation in push model agent binary * Refactor code to use new attestation.rs * Create attestation.rs for Attestation stuff * Move ContextInfo management to its own handler * Adjust context_info.rs after rebase * Add attestation function to ContextInfo structure * Add prohibited signing algorithms, avoid ecschnorr * keylime/config: Use macro to implement PushModelConfigTrait * Introduce keylime-macros and define_view_trait * config: Remove KeylimeConfig structure * config: Remove unnecessary options and lazy initialization * Fix pcr_bank function to send all possible slots * Send Content-Type:application/json on request (#1039) * Send correct 'key_algorithm' in certification_keys (#1035) * Push Model: Persist Attestation Key to file * Add Keylime push model binary to root GNUmakefile * Use singleton to avoid multiple Context allocation * tests: Do not assume `/var/lib/keylime` exists (#1030) * lib/cert: Fix race condition due to use of same file path * payloads: Fix race condition in tests * Add uefi_log_handler.rs to parse UEFI binary * Use IMA log parser to send correct entry count * Add IMA log parser * build(deps): bump once_cell from 1.19.0 to 1.21.3 * lib/config/base.rs: Add more unit tests * lib/permissions: Add unit tests * keylime-agent: move JsonWrapper from common.rs to the library * lib/agent_data: Move agent_data related tests from common * common: Replace APIVersion with the library Version structure * keylime_agent: Move secure_mount.rs to the library * lib: Rename keylime_error.rs as error.rs * config: Move config to keylime library * config: Rename push_model_config to push_model * lib: Move permissions.rs from keylime-agent to the lib * Extract Capabilities Negotiation info from TPM (#1014)
Patchnames
SUSE-SLE-Micro-6.0-461
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for rust-keylime",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for rust-keylime fixes the following issues:\n\n- Update vendored crate slab to version 0.4.11\n  * CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function \n    leading to undefined behavior or potential crash due to out-of-bounds \n    access (bsc#1248006)\n\n- Update to version 0.2.8+12:\n  * build(deps): bump actions/checkout from 4 to 5\n  * build(deps): bump cfg-if from 1.0.0 to 1.0.1\n  * build(deps): bump openssl from 0.10.72 to 0.10.73\n  * build(deps): bump clap from 4.5.39 to 4.5.45\n  * build(deps): bump pest from 2.8.0 to 2.8.1\n  * Fix clippy warnings\n  * Use verifier-provided interval for continuous attestation timing\n  * Add meta object with seconds_to_next_attestation to evidence response\n  * Fix boot time retrieval\n  * Fix IMA log format (it must be [\u0027text/plain\u0027]) (#1073)\n  * Remove unnecessary configuration fields\n  * cargo: Bump retry-policies to version 0.4.0\n\n- Update vendored crate shlex to version 1.3.0\n  * CVE-2024-58266: Fixed command injection (bsc#1247193) \n\n- Update to version 0.2.7+141:\n  * service: Use WantedBy=multi-user.target\n  * rpm: Add subpackage for push-attestation agent\n  * push-model: implement continuous attestation with configurable intervals\n  * Retry registration forever in the state machine\n  * Add Verifier URL to configuration\n  * Align exp.backoff to current configuration format\n  * Increase coverage of state machine (using Context)\n  * Increase coverage of struct_filler.rs\n  * Groom code (remove dead code)\n  * Fix exponential backoff (10secs, 4xx accepted)\n  * test: Add documentation test to tests/run.sh\n  * tpm: Avoid running code example during documentation tests\n  * state_machine: Always start the agent from the Unregistered state\n  * Add fixes for the URL construction\n  * Refactor evidences collection in push attestation agent\n  * push-model: refactor attestation logic into a state machine\n  * Fix body sending by allowing serializing strings (#1057)\n  * Log ResilientClient errors/response status codes (#1055)\n  * Add AK signing scheme and hash algorithm to negotiation\n  * tpm: Add method to extract signing scheme and hash algorithm from AK\n  * Allow custom content-type/accept headers\n  * Integrate exponential backoff to registration (#1052)\n  * keylime/structures: Rename ShaValues to PcrBanks\n  * Add resilient_client for exponential backoff (#1048)\n\n- Update vendored crate openssl 0.10.73:\n  * CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch (bsc#1242623) \n\n- Update to version 0.2.7+117:\n  * Increase coverage in evidence handling structure\n  * Add Capabilities Negotiations resp. missing fields\n  * Fix UEFI test to check file access in all cases\n  * context_info_handler: Do not assume /var/lib/keylime exists\n  * Fix clippy warnings about uninlined format arguments\n  * attestation: Allow unwrap() in tests\n  * Increase coverage (groom code, extend unit tests)\n  * Include IMA/UEFI logs in Evidence Handling request\n  * Include method to get all IMA entries as string\n  * Send correct list of pcr banks and sign algorithms\n  * Try to fix TPM tests related issues\n  * Define attestation perform asynchronous\n  * Perform attestation in push model agent binary\n  * Refactor code to use new attestation.rs\n  * Create attestation.rs for Attestation stuff\n  * Move ContextInfo management to its own handler\n  * Adjust context_info.rs after rebase\n  * Add attestation function to ContextInfo structure\n  * Add prohibited signing algorithms, avoid ecschnorr\n  * keylime/config: Use macro to implement PushModelConfigTrait\n  * Introduce keylime-macros and define_view_trait\n  * config: Remove KeylimeConfig structure\n  * config: Remove unnecessary options and lazy initialization\n  * Fix pcr_bank function to send all possible slots\n  * Send Content-Type:application/json on request (#1039)\n  * Send correct \u0027key_algorithm\u0027 in certification_keys (#1035)\n  * Push Model: Persist Attestation Key to file\n  * Add Keylime push model binary to root GNUmakefile\n  * Use singleton to avoid multiple Context allocation\n  * tests: Do not assume `/var/lib/keylime` exists (#1030)\n  * lib/cert: Fix race condition due to use of same file path\n  * payloads: Fix race condition in tests\n  * Add uefi_log_handler.rs to parse UEFI binary\n  * Use IMA log parser to send correct entry count\n  * Add IMA log parser\n  * build(deps): bump once_cell from 1.19.0 to 1.21.3\n  * lib/config/base.rs: Add more unit tests\n  * lib/permissions: Add unit tests\n  * keylime-agent: move JsonWrapper from common.rs to the library\n  * lib/agent_data: Move agent_data related tests from common\n  * common: Replace APIVersion with the library Version structure\n  * keylime_agent: Move secure_mount.rs to the library\n  * lib: Rename keylime_error.rs as error.rs\n  * config: Move config to keylime library\n  * config: Rename push_model_config to push_model\n  * lib: Move permissions.rs from keylime-agent to the lib\n  * Extract Capabilities Negotiation info from TPM (#1014)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-461",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20717-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:20717-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520717-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:20717-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-September/041931.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1242623",
        "url": "https://bugzilla.suse.com/1242623"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1247193",
        "url": "https://bugzilla.suse.com/1247193"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248006",
        "url": "https://bugzilla.suse.com/1248006"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-58266 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-58266/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3416 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3416/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55159 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55159/"
      }
    ],
    "title": "Security update for rust-keylime",
    "tracking": {
      "current_release_date": "2025-09-16T07:50:08Z",
      "generator": {
        "date": "2025-09-16T07:50:08Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:20717-1",
      "initial_release_date": "2025-09-16T07:50:08Z",
      "revision_history": [
        {
          "date": "2025-09-16T07:50:08Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rust-keylime-0.2.8+12-1.1.aarch64",
                "product": {
                  "name": "rust-keylime-0.2.8+12-1.1.aarch64",
                  "product_id": "rust-keylime-0.2.8+12-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rust-keylime-0.2.8+12-1.1.s390x",
                "product": {
                  "name": "rust-keylime-0.2.8+12-1.1.s390x",
                  "product_id": "rust-keylime-0.2.8+12-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rust-keylime-0.2.8+12-1.1.x86_64",
                "product": {
                  "name": "rust-keylime-0.2.8+12-1.1.x86_64",
                  "product_id": "rust-keylime-0.2.8+12-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rust-keylime-0.2.8+12-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64"
        },
        "product_reference": "rust-keylime-0.2.8+12-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rust-keylime-0.2.8+12-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x"
        },
        "product_reference": "rust-keylime-0.2.8+12-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rust-keylime-0.2.8+12-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
        },
        "product_reference": "rust-keylime-0.2.8+12-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-58266",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-58266"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64",
          "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x",
          "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-58266",
          "url": "https://www.suse.com/security/cve/CVE-2024-58266"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1247186 for CVE-2024-58266",
          "url": "https://bugzilla.suse.com/1247186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-16T07:50:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-58266"
    },
    {
      "cve": "CVE-2025-3416",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3416"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenSSL\u0027s handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64",
          "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x",
          "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3416",
          "url": "https://www.suse.com/security/cve/CVE-2025-3416"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1242599 for CVE-2025-3416",
          "url": "https://bugzilla.suse.com/1242599"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-16T07:50:08Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-3416"
    },
    {
      "cve": "CVE-2025-55159",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55159"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab\u0027s capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab\u0027s actual length.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64",
          "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x",
          "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55159",
          "url": "https://www.suse.com/security/cve/CVE-2025-55159"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248000 for CVE-2025-55159",
          "url": "https://bugzilla.suse.com/1248000"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.aarch64",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.s390x",
            "SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-16T07:50:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-55159"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.