opensuse-su-2025:15470-1
Vulnerability from csaf_opensuse
Published
2025-08-20 00:00
Modified
2025-08-20 00:00
Summary
govulncheck-vulndb-0.0.20250818T190335-1.1 on GA media

Notes

Title of the patch
govulncheck-vulndb-0.0.20250818T190335-1.1 on GA media
Description of the patch
These are all security issues fixed in the govulncheck-vulndb-0.0.20250818T190335-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15470
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "govulncheck-vulndb-0.0.20250818T190335-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the govulncheck-vulndb-0.0.20250818T190335-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15470",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15470-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-26154 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-26154/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-44001 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-44001/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-44004 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-44004/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-48731 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-48731/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-49221 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-49221/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-50946 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-50946/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52931 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52931/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53514 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53514/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53857 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53857/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53910 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53910/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-54458 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-54458/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-54463 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-54463/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-54478 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-54478/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-54525 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-54525/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55196 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55196/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55198 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55198/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55199 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55199/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-8285 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-8285/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-9039 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-9039/"
      }
    ],
    "title": "govulncheck-vulndb-0.0.20250818T190335-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-08-20T00:00:00Z",
      "generator": {
        "date": "2025-08-20T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15470-1",
      "initial_release_date": "2025-08-20T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-08-20T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
                  "product_id": "govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
                  "product_id": "govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
                  "product_id": "govulncheck-vulndb-0.0.20250818T190335-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64",
                  "product_id": "govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-26154",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-26154"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.\r\r**Note:**\r\rIn order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-26154",
          "url": "https://www.suse.com/security/cve/CVE-2023-26154"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-26154"
    },
    {
      "cve": "CVE-2025-44001",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-44001"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-44001",
          "url": "https://www.suse.com/security/cve/CVE-2025-44001"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-44001"
    },
    {
      "cve": "CVE-2025-44004",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-44004"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-44004",
          "url": "https://www.suse.com/security/cve/CVE-2025-44004"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-44004"
    },
    {
      "cve": "CVE-2025-48731",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-48731"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the user does not have access for via edit subscription endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-48731",
          "url": "https://www.suse.com/security/cve/CVE-2025-48731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-48731"
    },
    {
      "cve": "CVE-2025-49221",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-49221"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-49221",
          "url": "https://www.suse.com/security/cve/CVE-2025-49221"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-49221"
    },
    {
      "cve": "CVE-2025-50946",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-50946"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-50946",
          "url": "https://www.suse.com/security/cve/CVE-2025-50946"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-50946"
    },
    {
      "cve": "CVE-2025-52931",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52931"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52931",
          "url": "https://www.suse.com/security/cve/CVE-2025-52931"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-52931"
    },
    {
      "cve": "CVE-2025-53514",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53514"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53514",
          "url": "https://www.suse.com/security/cve/CVE-2025-53514"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-53514"
    },
    {
      "cve": "CVE-2025-53857",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53857"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53857",
          "url": "https://www.suse.com/security/cve/CVE-2025-53857"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-53857"
    },
    {
      "cve": "CVE-2025-53910",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53910"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription without proper access to the channel via API call to the edit channel subscription endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53910",
          "url": "https://www.suse.com/security/cve/CVE-2025-53910"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-53910"
    },
    {
      "cve": "CVE-2025-54458",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-54458"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a Confluence space the user does not have access to via the create subscription endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-54458",
          "url": "https://www.suse.com/security/cve/CVE-2025-54458"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-54458"
    },
    {
      "cve": "CVE-2025-54463",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-54463"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-54463",
          "url": "https://www.suse.com/security/cve/CVE-2025-54463"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-54463"
    },
    {
      "cve": "CVE-2025-54478",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-54478"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-54478",
          "url": "https://www.suse.com/security/cve/CVE-2025-54478"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-54478"
    },
    {
      "cve": "CVE-2025-54525",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-54525"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoint with an invalid request body.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-54525",
          "url": "https://www.suse.com/security/cve/CVE-2025-54525"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-54525"
    },
    {
      "cve": "CVE-2025-55196",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55196"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. This vulnerability has been patched in version 0.19.2. A workaround for this issue includes auditing and restricting RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55196",
          "url": "https://www.suse.com/security/cve/CVE-2025-55196"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "not set"
        }
      ],
      "title": "CVE-2025-55196"
    },
    {
      "cve": "CVE-2025-55198",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55198"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55198",
          "url": "https://www.suse.com/security/cve/CVE-2025-55198"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248092 for CVE-2025-55198",
          "url": "https://bugzilla.suse.com/1248092"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-55198"
    },
    {
      "cve": "CVE-2025-55199",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55199"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55199",
          "url": "https://www.suse.com/security/cve/CVE-2025-55199"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248093 for CVE-2025-55199",
          "url": "https://bugzilla.suse.com/1248093"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-55199"
    },
    {
      "cve": "CVE-2025-8285",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-8285"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost Confluence Plugin version \u003c1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-8285",
          "url": "https://www.suse.com/security/cve/CVE-2025-8285"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-8285"
    },
    {
      "cve": "CVE-2025-9039",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-9039"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is hosted. This issue does not affect instances where the option to allow off-host access to the introspection server is set to \u0027false\u0027.\n\nThis issue has been addressed in ECS agent version 1.97.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\nIf customers cannot update to the latest AMI, they can modify the Amazon EC2 security groups to restrict incoming access to the introspection server port (51678).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-9039",
          "url": "https://www.suse.com/security/cve/CVE-2025-9039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250818T190335-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-20T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-9039"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.