nss vulnerability

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202010-0251",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ruggedcom rox rx1400",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ruggedcom rox rx1512",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "hci storage node",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "ruggedcom rox rx1510",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ruggedcom rox rx5000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ruggedcom rox rx1501",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "hci management node",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "solidfire",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "hci compute node",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "ruggedcom rox rx1511",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ruggedcom rox mx5000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ruggedcom rox rx1500",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "network security services",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "3.46"
      },
      {
        "model": "network security services",
        "scope": null,
        "trust": 0.8,
        "vendor": "mozilla",
        "version": null
      },
      {
        "model": "hci management node",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "solidfire",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "hci compute node",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "hci storage node",
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "ruggedcom rox mx5000",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "ruggedcom rox rx1400",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "ruggedcom rox rx1500",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "ruggedcom rox rx1501",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "ruggedcom rox rx1510",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "ruggedcom rox rx1511",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "ruggedcom rox rx1512",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "ruggedcom rox rx5000",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17006"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "159661"
      },
      {
        "db": "PACKETSTORM",
        "id": "161727"
      },
      {
        "db": "PACKETSTORM",
        "id": "162142"
      },
      {
        "db": "PACKETSTORM",
        "id": "162130"
      },
      {
        "db": "PACKETSTORM",
        "id": "161916"
      },
      {
        "db": "PACKETSTORM",
        "id": "159497"
      },
      {
        "db": "PACKETSTORM",
        "id": "158724"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2019-17006",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2019-17006",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2019-17006",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2019-17006",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2019-17006",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2019-17006",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "VULMON",
            "id": "CVE-2019-17006",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-17006"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17006"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow. Network Security Services (NSS) Exists in an inadequate validation of data reliability vulnerabilities.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. =========================================================================\nUbuntu Security Notice USN-4231-1\nJanuary 08, 2020\n\nnss vulnerability\n=========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 19.10\n- Ubuntu 19.04\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n- Ubuntu 14.04 ESM\n- Ubuntu 12.04 ESM\n\nSummary:\n\nNSS could be made to execute arbitrary code if it received a specially\ncrafted input. An\nattacker could possibly use this issue to execute arbitrary code. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 19.10:\n  libnss3                         2:3.45-1ubuntu2.2\n\nUbuntu 19.04:\n  libnss3                         2:3.42-1ubuntu2.5\n\nUbuntu 18.04 LTS:\n  libnss3                         2:3.35-2ubuntu2.7\n\nUbuntu 16.04 LTS:\n  libnss3                         2:3.28.4-0ubuntu0.16.04.10\n\nUbuntu 14.04 ESM:\n  libnss3                         2:3.28.4-0ubuntu0.14.04.5+esm4\n\nUbuntu 12.04 ESM:\n  libnss3                         2:3.28.4-0ubuntu0.12.04.7\n\nAfter a standard system update you need to reboot your computer to make\nall the necessary changes. \n\nBug Fix(es):\n\n* Gather image registry config (backport to 4.3) (BZ#1836815)\n\n* Builds fail after running postCommit script if OCP cluster is configured\nwith a container registry whitelist (BZ#1849176)\n\n* Login with OpenShift not working after cluster upgrade (BZ#1852429)\n\n* Limit the size of gathered federated metrics from alerts in Insights\nOperator (BZ#1874018)\n\n* [4.3] Storage operator stops reconciling when going Upgradeable=False on\nv1alpha1 CRDs (BZ#1879110)\n\n* [release 4.3] OpenShift APIs become unavailable for more than 15 minutes\nafter one of master nodes went down(OAuth) (BZ#1880293)\n\nYou may download the oc tool and use it to inspect release image metadata\nas follows:\n\n(For x86_64 architecture)\n\n  $ oc adm release info\nquay.io/openshift-release-dev/ocp-release:4.3.40-x86_64\n\nThe image digest is\nsha256:9ff90174a170379e90a9ead6e0d8cf6f439004191f80762764a5ca3dbaab01dc\n\n(For s390x architecture)\n\n  $ oc adm release info\nquay.io/openshift-release-dev/ocp-release:4.3.40-s390x\nThe image digest is\nsha256:605ddde0442e604cfe2d6bd1541ce48df5956fe626edf9cc95b1fca75d231b64\n\n(For ppc64le architecture)\n\n  $ oc adm release info\nquay.io/openshift-release-dev/ocp-release:4.3.40-ppc64le\n\nThe image digest is\nsha256:d3c9e391c145338eae3feb7f6a4e487dadc8139a353117d642fe686d277bcccc\n\n3. Solution:\n\nFor OpenShift Container Platform 4.3 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-rel\nease-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.3/updating/updating-cluster\n- -cli.html. Bugs fixed (https://bugzilla.redhat.com/):\n\n1804533 - CVE-2020-9283 golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic\n1836815 - Gather image registry config (backport to 4.3)\n1849176 - Builds fail after running postCommit script if OCP cluster is configured with a container registry whitelist\n1874018 - Limit the size of gathered federated metrics from alerts in Insights Operator\n1874399 - [DR] etcd-member-recover.sh fails to pull image with unauthorized\n1879110 - [4.3] Storage operator stops reconciling when going Upgradeable=False on v1alpha1 CRDs\n\n5. Solution:\n\nFor information on upgrading Ansible Tower, reference the Ansible Tower\nUpgrade and Migration Guide:\nhttps://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/\nindex.html\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1790277 - CVE-2019-20372 nginx: HTTP request smuggling in configurations with URL redirect used as error_page\n1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method\n1850004 - CVE-2020-11023 jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution\n1911314 - CVE-2020-35678 python-autobahn: allows redirect header injection\n1928847 - CVE-2021-20253 ansible-tower: Privilege escalation via job isolation escape\n\n5. \n\nAnsible Automation Platform manages Ansible Platform jobs and workflows\nthat can interface with any infrastructure on a Red Hat OpenShift Container\nPlatform cluster, or on a traditional infrastructure that is running\noff-cluster. Bugs fixed (https://bugzilla.redhat.com/):\n\n1914774 - CVE-2021-20178 ansible: user data leak in snmp_facts module\n1915808 - CVE-2021-20180 ansible module: bitbucket_pipeline_variable exposes secured values\n1916813 - CVE-2021-20191 ansible: multiple modules expose secured values\n1925002 - CVE-2021-20228 ansible: basic.py no_log with fallback option\n1939349 - CVE-2021-3447 ansible: multiple modules expose secured values\n\n5. Description:\n\nRed Hat 3scale API Management delivers centralized API management features\nthrough a distributed, cloud-hosted layer. It includes built-in features to\nhelp in building a more successful API program, including access control,\nrate limits, payment gateway integration, and developer experience tools. \n\nThis advisory is intended to use with container images for Red Hat 3scale\nAPI Management 2.10.0. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):\n\n1804533 - CVE-2020-9283 golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic\n1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash\n\n5. Description:\n\nRed Hat OpenShift Do (odo) is a simple CLI tool for developers to create,\nbuild, and deploy applications on OpenShift. The odo tool is completely\nclient-based and requires no server within the OpenShift cluster for\ndeployment. It detects changes to local code and deploys it to the cluster\nautomatically, giving instant feedback to validate changes in real-time. It\nsupports multiple programming languages and frameworks. \n\nThe advisory addresses the following issues:\n\n* Re-release of odo-init-image 1.1.3 for security updates\n\n3. Solution:\n\nDownload and install a new CLI binary by following the instructions linked\nfrom the References section. Bugs fixed (https://bugzilla.redhat.com/):\n\n1832983 - Release of 1.1.3 odo-init-image\n\n5. \n\nBug Fix(es):\n\n* Container-native Virtualization 2.4.2 Images (BZ#1877407)\n\nThis advisory contains the following OpenShift Virtualization 2.4.2 images:\n\nRHEL-7-CNV-2.4\n=============kubevirt-ssp-operator-container-v2.4.2-2\n\nRHEL-8-CNV-2.4\n=============virt-cdi-controller-container-v2.4.2-1\nvirt-cdi-apiserver-container-v2.4.2-1\nhostpath-provisioner-operator-container-v2.4.2-1\nvirt-cdi-uploadproxy-container-v2.4.2-1\nvirt-cdi-cloner-container-v2.4.2-1\nvirt-cdi-importer-container-v2.4.2-1\nkubevirt-template-validator-container-v2.4.2-1\nhostpath-provisioner-container-v2.4.2-1\nvirt-cdi-uploadserver-container-v2.4.2-1\nvirt-cdi-operator-container-v2.4.2-1\nvirt-controller-container-v2.4.2-1\nkubevirt-cpu-model-nfd-plugin-container-v2.4.2-1\nvirt-api-container-v2.4.2-1\novs-cni-marker-container-v2.4.2-1\nkubevirt-cpu-node-labeller-container-v2.4.2-1\nbridge-marker-container-v2.4.2-1\nkubevirt-metrics-collector-container-v2.4.2-1\nkubemacpool-container-v2.4.2-1\ncluster-network-addons-operator-container-v2.4.2-1\novs-cni-plugin-container-v2.4.2-1\nkubernetes-nmstate-handler-container-v2.4.2-1\ncnv-containernetworking-plugins-container-v2.4.2-1\nvirtio-win-container-v2.4.2-1\nvirt-handler-container-v2.4.2-1\nvirt-launcher-container-v2.4.2-1\ncnv-must-gather-container-v2.4.2-1\nvirt-operator-container-v2.4.2-1\nvm-import-controller-container-v2.4.2-1\nhyperconverged-cluster-operator-container-v2.4.2-1\nvm-import-operator-container-v2.4.2-1\nkubevirt-vmware-container-v2.4.2-1\nkubevirt-v2v-conversion-container-v2.4.2-1\nkubevirt-kvm-info-nfd-plugin-container-v2.4.2-1\nnode-maintenance-operator-container-v2.4.2-1\nhco-bundle-registry-container-v2.4.2-15\n\n3. Bugs fixed (https://bugzilla.redhat.com/):\n\n1856953 - CVE-2020-15586 golang: data race in certain net/http servers including ReverseProxy can lead to DoS\n1867099 - CVE-2020-16845 golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs\n1869194 - HCO CR display name should contain \"OpenShift Virtualization\" instead of CNV\n1869734 - OpenShift Virtualization does not appear in OperatorHub when filtering to \"Disconnected\"\n1875383 - terminationGracePeriodSeconds should be updated in VMs created from common templates\n1877407 - Container-native Virtualization 2.4.2 Images\n\n5. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Moderate: nss and nspr security, bug fix, and enhancement update\nAdvisory ID:       RHSA-2020:3280-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2020:3280\nIssue date:        2020-08-03\nCVE Names:         CVE-2019-11756 CVE-2019-17006 CVE-2019-17023\n                   CVE-2020-12402\n====================================================================\n1. Summary:\n\nAn update for nss and nspr is now available for Red Hat Enterprise Linux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64\n\n3. Description:\n\nNetwork Security Services (NSS) is a set of libraries designed to support\nthe cross-platform development of security-enabled client and server\napplications. \n\nNetscape Portable Runtime (NSPR) provides platform independence for non-GUI\noperating system facilities. \n\nThe following packages have been upgraded to a later upstream version: nss\n(3.53.1), nspr (4.25.0). (BZ#1809549, BZ#1809550)\n\nSecurity Fix(es):\n\n* nss: UAF in sftk_FreeSession due to improper refcounting (CVE-2019-11756)\n\n* nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)\n\n* nss: Side channel vulnerabilities during RSA key generation\n(CVE-2020-12402)\n\n* nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid\nstate (CVE-2019-17023)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nBug Fix(es):\n\n* Install of update of nss.x86_64 adds i686 into transaction (BZ#1663187)\n\n* NSS does not set downgrade sentinel in ServerHello.random for TLS 1.0 and\nTLS 1.1 (BZ#1691409)\n\n* TLS Keying Material Exporter is unsupported by command line tools\n(BZ#1691454)\n\n* TLS_AES_256_GCM_SHA384 is not marked as FIPS compatible (BZ#1711375)\n\n* Make TLS 1.3 work in FIPS mode (BZ#1724250)\n\n* NSS rejects records with large padding with SHA384 HMAC (BZ#1750921)\n\n* NSS missing IKEv1 Quick Mode KDF (BZ#1809637)\n\n* Name Constraints validation: CN treated as DNS name even when\nsyntactically invalid as DNS name (BZ#1825270)\n\n* FIPS needs nss to restrict valid dh primes to those primes that are\napproved. (BZ#1854564)\n\n* nss needs to comply to the new SP800-56A rev 3 requirements (BZ#1855825)\n\nEnhancement(s):\n\n* [RFE] nss should use AES for storage of keys (BZ#1723819)\n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, applications using NSS (for example, Firefox)\nmust be restarted for this update to take effect. After installing this\nupdate, applications using NSPR (for example, Firefox) must be restarted\nfor this update to take effect. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1663187 - Install of update of nss.x86_64 adds i686 into transaction\n1691454 - TLS Keying Material Exporter is unsupported by command line tools\n1711375 - TLS_AES_256_GCM_SHA384 is not marked as FIPS compatible\n1724250 - Make TLS 1.3 work in FIPS mode [rhel-8]\n1750921 - NSS rejects records with large padding with SHA384 HMAC\n1774835 - CVE-2019-11756 nss: UAF in sftk_FreeSession due to improper refcounting\n1775916 - CVE-2019-17006 nss: Check length of inputs for cryptographic primitives\n1791225 - CVE-2019-17023 nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state\n1809637 - NSS missing IKEv1 Quick Mode KDF\n1825270 - Name Constraints validation: CN treated as DNS name even when syntactically invalid as DNS name\n1826231 - CVE-2020-12402 nss: Side channel vulnerabilities during RSA key generation\n1854564 - FIPS needs nss to restrict valid dh primes to those primes that are approved. [rhel-8.2.0.z]\n\n6. Package List:\n\nRed Hat Enterprise Linux AppStream (v. 8):\n\nSource:\nnspr-4.25.0-2.el8_2.src.rpm\nnss-3.53.1-11.el8_2.src.rpm\n\naarch64:\nnspr-4.25.0-2.el8_2.aarch64.rpm\nnspr-debuginfo-4.25.0-2.el8_2.aarch64.rpm\nnspr-debugsource-4.25.0-2.el8_2.aarch64.rpm\nnspr-devel-4.25.0-2.el8_2.aarch64.rpm\nnss-3.53.1-11.el8_2.aarch64.rpm\nnss-debuginfo-3.53.1-11.el8_2.aarch64.rpm\nnss-debugsource-3.53.1-11.el8_2.aarch64.rpm\nnss-devel-3.53.1-11.el8_2.aarch64.rpm\nnss-softokn-3.53.1-11.el8_2.aarch64.rpm\nnss-softokn-debuginfo-3.53.1-11.el8_2.aarch64.rpm\nnss-softokn-devel-3.53.1-11.el8_2.aarch64.rpm\nnss-softokn-freebl-3.53.1-11.el8_2.aarch64.rpm\nnss-softokn-freebl-debuginfo-3.53.1-11.el8_2.aarch64.rpm\nnss-softokn-freebl-devel-3.53.1-11.el8_2.aarch64.rpm\nnss-sysinit-3.53.1-11.el8_2.aarch64.rpm\nnss-sysinit-debuginfo-3.53.1-11.el8_2.aarch64.rpm\nnss-tools-3.53.1-11.el8_2.aarch64.rpm\nnss-tools-debuginfo-3.53.1-11.el8_2.aarch64.rpm\nnss-util-3.53.1-11.el8_2.aarch64.rpm\nnss-util-debuginfo-3.53.1-11.el8_2.aarch64.rpm\nnss-util-devel-3.53.1-11.el8_2.aarch64.rpm\n\nppc64le:\nnspr-4.25.0-2.el8_2.ppc64le.rpm\nnspr-debuginfo-4.25.0-2.el8_2.ppc64le.rpm\nnspr-debugsource-4.25.0-2.el8_2.ppc64le.rpm\nnspr-devel-4.25.0-2.el8_2.ppc64le.rpm\nnss-3.53.1-11.el8_2.ppc64le.rpm\nnss-debuginfo-3.53.1-11.el8_2.ppc64le.rpm\nnss-debugsource-3.53.1-11.el8_2.ppc64le.rpm\nnss-devel-3.53.1-11.el8_2.ppc64le.rpm\nnss-softokn-3.53.1-11.el8_2.ppc64le.rpm\nnss-softokn-debuginfo-3.53.1-11.el8_2.ppc64le.rpm\nnss-softokn-devel-3.53.1-11.el8_2.ppc64le.rpm\nnss-softokn-freebl-3.53.1-11.el8_2.ppc64le.rpm\nnss-softokn-freebl-debuginfo-3.53.1-11.el8_2.ppc64le.rpm\nnss-softokn-freebl-devel-3.53.1-11.el8_2.ppc64le.rpm\nnss-sysinit-3.53.1-11.el8_2.ppc64le.rpm\nnss-sysinit-debuginfo-3.53.1-11.el8_2.ppc64le.rpm\nnss-tools-3.53.1-11.el8_2.ppc64le.rpm\nnss-tools-debuginfo-3.53.1-11.el8_2.ppc64le.rpm\nnss-util-3.53.1-11.el8_2.ppc64le.rpm\nnss-util-debuginfo-3.53.1-11.el8_2.ppc64le.rpm\nnss-util-devel-3.53.1-11.el8_2.ppc64le.rpm\n\ns390x:\nnspr-4.25.0-2.el8_2.s390x.rpm\nnspr-debuginfo-4.25.0-2.el8_2.s390x.rpm\nnspr-debugsource-4.25.0-2.el8_2.s390x.rpm\nnspr-devel-4.25.0-2.el8_2.s390x.rpm\nnss-3.53.1-11.el8_2.s390x.rpm\nnss-debuginfo-3.53.1-11.el8_2.s390x.rpm\nnss-debugsource-3.53.1-11.el8_2.s390x.rpm\nnss-devel-3.53.1-11.el8_2.s390x.rpm\nnss-softokn-3.53.1-11.el8_2.s390x.rpm\nnss-softokn-debuginfo-3.53.1-11.el8_2.s390x.rpm\nnss-softokn-devel-3.53.1-11.el8_2.s390x.rpm\nnss-softokn-freebl-3.53.1-11.el8_2.s390x.rpm\nnss-softokn-freebl-debuginfo-3.53.1-11.el8_2.s390x.rpm\nnss-softokn-freebl-devel-3.53.1-11.el8_2.s390x.rpm\nnss-sysinit-3.53.1-11.el8_2.s390x.rpm\nnss-sysinit-debuginfo-3.53.1-11.el8_2.s390x.rpm\nnss-tools-3.53.1-11.el8_2.s390x.rpm\nnss-tools-debuginfo-3.53.1-11.el8_2.s390x.rpm\nnss-util-3.53.1-11.el8_2.s390x.rpm\nnss-util-debuginfo-3.53.1-11.el8_2.s390x.rpm\nnss-util-devel-3.53.1-11.el8_2.s390x.rpm\n\nx86_64:\nnspr-4.25.0-2.el8_2.i686.rpm\nnspr-4.25.0-2.el8_2.x86_64.rpm\nnspr-debuginfo-4.25.0-2.el8_2.i686.rpm\nnspr-debuginfo-4.25.0-2.el8_2.x86_64.rpm\nnspr-debugsource-4.25.0-2.el8_2.i686.rpm\nnspr-debugsource-4.25.0-2.el8_2.x86_64.rpm\nnspr-devel-4.25.0-2.el8_2.i686.rpm\nnspr-devel-4.25.0-2.el8_2.x86_64.rpm\nnss-3.53.1-11.el8_2.i686.rpm\nnss-3.53.1-11.el8_2.x86_64.rpm\nnss-debuginfo-3.53.1-11.el8_2.i686.rpm\nnss-debuginfo-3.53.1-11.el8_2.x86_64.rpm\nnss-debugsource-3.53.1-11.el8_2.i686.rpm\nnss-debugsource-3.53.1-11.el8_2.x86_64.rpm\nnss-devel-3.53.1-11.el8_2.i686.rpm\nnss-devel-3.53.1-11.el8_2.x86_64.rpm\nnss-softokn-3.53.1-11.el8_2.i686.rpm\nnss-softokn-3.53.1-11.el8_2.x86_64.rpm\nnss-softokn-debuginfo-3.53.1-11.el8_2.i686.rpm\nnss-softokn-debuginfo-3.53.1-11.el8_2.x86_64.rpm\nnss-softokn-devel-3.53.1-11.el8_2.i686.rpm\nnss-softokn-devel-3.53.1-11.el8_2.x86_64.rpm\nnss-softokn-freebl-3.53.1-11.el8_2.i686.rpm\nnss-softokn-freebl-3.53.1-11.el8_2.x86_64.rpm\nnss-softokn-freebl-debuginfo-3.53.1-11.el8_2.i686.rpm\nnss-softokn-freebl-debuginfo-3.53.1-11.el8_2.x86_64.rpm\nnss-softokn-freebl-devel-3.53.1-11.el8_2.i686.rpm\nnss-softokn-freebl-devel-3.53.1-11.el8_2.x86_64.rpm\nnss-sysinit-3.53.1-11.el8_2.x86_64.rpm\nnss-sysinit-debuginfo-3.53.1-11.el8_2.i686.rpm\nnss-sysinit-debuginfo-3.53.1-11.el8_2.x86_64.rpm\nnss-tools-3.53.1-11.el8_2.x86_64.rpm\nnss-tools-debuginfo-3.53.1-11.el8_2.i686.rpm\nnss-tools-debuginfo-3.53.1-11.el8_2.x86_64.rpm\nnss-util-3.53.1-11.el8_2.i686.rpm\nnss-util-3.53.1-11.el8_2.x86_64.rpm\nnss-util-debuginfo-3.53.1-11.el8_2.i686.rpm\nnss-util-debuginfo-3.53.1-11.el8_2.x86_64.rpm\nnss-util-devel-3.53.1-11.el8_2.i686.rpm\nnss-util-devel-3.53.1-11.el8_2.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2019-11756\nhttps://access.redhat.com/security/cve/CVE-2019-17006\nhttps://access.redhat.com/security/cve/CVE-2019-17023\nhttps://access.redhat.com/security/cve/CVE-2020-12402\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXygK2tzjgjWX9erEAQh0Aw/+LaczkzsxBl+tYKZywwODehAp/M3l8/jt\nfB2SDHzLAHWCW8rs6S0c9Xu2Bgny8JnCh3sqHHZU3FfUjc7sb1OXhLrBNpLBcuqi\nlEsVxW1DTDggVG+L6NPCttadHFiPofFW6uVAJe0PaZzsMxHwXCxL+YJriAIzt0vf\n/dTUEUPVo1erv/DjfI3jycgKwmgeVpsZEcame/vD0gcSx3nBvdjFsCpSU9lddcp4\nziKp5Dh/nHF50ARggt4xQcU5q6g6Zpd7qlp3NeWOZCPk/HidlVPO3ertrhcM4BzZ\nabND+jg3cPAu+drzlb0qhxDxrXLmGpK6JxcieMcj4Uqw117IxrSfep9AtFol7tjb\nit81cjQh8MOHxHisBMeiY9LM6Cqu6dED+CKynaBKSVJIjko0nzlzst0vVDAsvxB4\nqQFD5kWJ47jEkH2E8sFIS2IU4+yASHiWi8D+ybZjz4uiQG3CtYgE7YTbowoE/Ecw\nbFigQXNmjj6np61h1Y7zMsZt2VRp4nQfk0tbmLgcdS/eRKBzs7nr0NfvTo/vWvQT\n/wRkDSf2DuoPgFYGIIc2OaMt3OCBZJsVWSIusmS3PmUglVIhHbbA5XacMLwJxzuz\noHp62/RF0+yVfSQFggjn6lWqxqMCTvXbczH6yDSelxx6+4CLi88jjLh7ujr7mmnV\nWWt+Qo5f7BI=oabi\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-17006"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-17006"
      },
      {
        "db": "PACKETSTORM",
        "id": "155889"
      },
      {
        "db": "PACKETSTORM",
        "id": "159661"
      },
      {
        "db": "PACKETSTORM",
        "id": "161727"
      },
      {
        "db": "PACKETSTORM",
        "id": "162142"
      },
      {
        "db": "PACKETSTORM",
        "id": "162130"
      },
      {
        "db": "PACKETSTORM",
        "id": "161916"
      },
      {
        "db": "PACKETSTORM",
        "id": "159497"
      },
      {
        "db": "PACKETSTORM",
        "id": "158724"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-17006",
        "trust": 2.7
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-21-040-04",
        "trust": 1.9
      },
      {
        "db": "SIEMENS",
        "id": "SSA-379803",
        "trust": 1.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070",
        "trust": 0.8
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-17006",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "155889",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "159661",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "161727",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "162142",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "162130",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "161916",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "159497",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "158724",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-17006"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      },
      {
        "db": "PACKETSTORM",
        "id": "155889"
      },
      {
        "db": "PACKETSTORM",
        "id": "159661"
      },
      {
        "db": "PACKETSTORM",
        "id": "161727"
      },
      {
        "db": "PACKETSTORM",
        "id": "162142"
      },
      {
        "db": "PACKETSTORM",
        "id": "162130"
      },
      {
        "db": "PACKETSTORM",
        "id": "161916"
      },
      {
        "db": "PACKETSTORM",
        "id": "159497"
      },
      {
        "db": "PACKETSTORM",
        "id": "158724"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17006"
      }
    ]
  },
  "id": "VAR-202010-0251",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.52540106
  },
  "last_update_date": "2024-09-19T21:43:26.192000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "NTAP-20210129-0001 Siemens Siemens\u00a0Security\u00a0Advisory",
        "trust": 0.8,
        "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes"
      },
      {
        "title": "Ubuntu Security Notice: nss vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-4231-1"
      },
      {
        "title": "Red Hat: Moderate: nss and nspr security, bug fix, and enhancement update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203280 - Security Advisory"
      },
      {
        "title": "IBM: Security Bulletin:  A security vulnerabilitiy has been fixed in IBM Security Identity Manager Virtual Appliance(CVE-2019-17006)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=a91447c5697ecfb6bbab6f4cf67cb949"
      },
      {
        "title": "Red Hat: Moderate: nss and nspr security, bug fix, and enhancement update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20204076 - Security Advisory"
      },
      {
        "title": "Debian Security Advisories: DSA-4726-1 nss -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=2610caa3eacc40f97585be7c579718bd"
      },
      {
        "title": "Red Hat: Low: OpenShift Virtualization 2.4.2 Images",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20204201 - Security Advisory"
      },
      {
        "title": "IBM: Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=52844442ae85845bde006e7f0170408e"
      },
      {
        "title": "Red Hat: Moderate: security update - Red Hat Ansible Tower 3.6 runner release (CVE-2019-18874)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20204255 - Security Advisory"
      },
      {
        "title": "Red Hat: Moderate: security update - Red Hat Ansible Tower 3.7 runner release (CVE-2019-18874)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20204254 - Security Advisory"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=409c1cd1b8ef401020956950fd839000"
      },
      {
        "title": "Red Hat: Low: OpenShift Container Platform 4.3.40 security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20204264 - Security Advisory"
      },
      {
        "title": "zot",
        "trust": 0.1,
        "url": "https://github.com/anuvu/zot "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-17006"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-20",
        "trust": 1.0
      },
      {
        "problemtype": "Inadequate verification of data reliability (CWE-345) [NVD Evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17006"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"
      },
      {
        "trust": 1.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17006"
      },
      {
        "trust": 1.1,
        "url": "https://developer.mozilla.org/en-us/docs/mozilla/projects/nss/nss_3.46_release_notes"
      },
      {
        "trust": 1.1,
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1539788"
      },
      {
        "trust": 1.1,
        "url": "https://security.netapp.com/advisory/ntap-20210129-0001/"
      },
      {
        "trust": 1.1,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2019-17023"
      },
      {
        "trust": 0.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17023"
      },
      {
        "trust": 0.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11756"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2019-11756"
      },
      {
        "trust": 0.7,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2019-17006"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2020-12402"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12402"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2019-12749"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14866"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-6829"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-12403"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2019-20388"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-12243"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2019-17498"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12749"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-7595"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19956"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2019-19956"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-12400"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2019-11727"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11719"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2019-15903"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2018-20843"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2020-12401"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20843"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2019-11719"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20388"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2019-14866"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11727"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-15903"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17498"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-5094"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-5188"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-5094"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-5188"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-20907"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1971"
      },
      {
        "trust": 0.4,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12401"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-8177"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12400"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12243"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2020-1971"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12403"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20907"
      },
      {
        "trust": 0.3,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-19126"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-12652"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-14973"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2019-17546"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-14352"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-12825"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14973"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2017-12652"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17546"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-9283"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19126"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12723"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-20228"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2020-12723"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-20191"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-20180"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2021-20178"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/345.html"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4231-1/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/111311"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4231-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nss/2:3.45-1ubuntu2.2"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nss/2:3.42-1ubuntu2.5"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nss/2:3.35-2ubuntu2.7"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nss/2:3.28.4-0ubuntu0.16.04.10"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:4264"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-2974"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11068"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-18197"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-5482"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-18197"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-2226"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-2780"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-16935"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-12450"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2974"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-2752"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-20386"
      },
      {
        "trust": 0.1,
        "url": "https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-rel"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-2574"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-14822"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14822"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16935"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-2225"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-5482"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-8492"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-18190"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-8696"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-2181"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12450"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-2182"
      },
      {
        "trust": 0.1,
        "url": "https://docs.openshift.com/container-platform/4.3/updating/updating-cluster"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-8675"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20386"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-18190"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-24750"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-2224"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-11068"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-2812"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11023"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20372"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10878"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-20253"
      },
      {
        "trust": 0.1,
        "url": "https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11023"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:0778"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11022"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10543"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5766"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10878"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-5766"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-20372"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11022"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10543"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-35678"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:1079"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-8625"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-15999"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3156"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-3447"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-5313"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15999"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-5313"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14422"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14422"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25211"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:1129"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25645"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_3scale_api_management"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25656"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-28374"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14351"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25705"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.10/html-single/installing_3scale/index"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-29661"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-20265"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-0427"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14351"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-19532"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-7053"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14040"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14040"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-0427"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19532"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:0949"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8177"
      },
      {
        "trust": 0.1,
        "url": "https://docs.openshift.com/container-platform/4.4/cli_reference/openshift_developer_cli/installing-odo.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-7595"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6829"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-15586"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14352"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-16845"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14365"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-16845"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:4201"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15586"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14365"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-12825"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:3280"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-17006"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      },
      {
        "db": "PACKETSTORM",
        "id": "155889"
      },
      {
        "db": "PACKETSTORM",
        "id": "159661"
      },
      {
        "db": "PACKETSTORM",
        "id": "161727"
      },
      {
        "db": "PACKETSTORM",
        "id": "162142"
      },
      {
        "db": "PACKETSTORM",
        "id": "162130"
      },
      {
        "db": "PACKETSTORM",
        "id": "161916"
      },
      {
        "db": "PACKETSTORM",
        "id": "159497"
      },
      {
        "db": "PACKETSTORM",
        "id": "158724"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17006"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2019-17006"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      },
      {
        "db": "PACKETSTORM",
        "id": "155889"
      },
      {
        "db": "PACKETSTORM",
        "id": "159661"
      },
      {
        "db": "PACKETSTORM",
        "id": "161727"
      },
      {
        "db": "PACKETSTORM",
        "id": "162142"
      },
      {
        "db": "PACKETSTORM",
        "id": "162130"
      },
      {
        "db": "PACKETSTORM",
        "id": "161916"
      },
      {
        "db": "PACKETSTORM",
        "id": "159497"
      },
      {
        "db": "PACKETSTORM",
        "id": "158724"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-17006"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-10-22T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-17006"
      },
      {
        "date": "2021-05-12T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      },
      {
        "date": "2020-01-09T15:06:17",
        "db": "PACKETSTORM",
        "id": "155889"
      },
      {
        "date": "2020-10-21T15:40:32",
        "db": "PACKETSTORM",
        "id": "159661"
      },
      {
        "date": "2021-03-09T16:25:11",
        "db": "PACKETSTORM",
        "id": "161727"
      },
      {
        "date": "2021-04-09T15:06:13",
        "db": "PACKETSTORM",
        "id": "162142"
      },
      {
        "date": "2021-04-08T14:00:00",
        "db": "PACKETSTORM",
        "id": "162130"
      },
      {
        "date": "2021-03-22T15:36:55",
        "db": "PACKETSTORM",
        "id": "161916"
      },
      {
        "date": "2020-10-07T16:06:29",
        "db": "PACKETSTORM",
        "id": "159497"
      },
      {
        "date": "2020-08-03T17:14:53",
        "db": "PACKETSTORM",
        "id": "158724"
      },
      {
        "date": "2020-10-22T21:15:12.560000",
        "db": "NVD",
        "id": "CVE-2019-17006"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-02-19T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-17006"
      },
      {
        "date": "2021-05-12T08:27:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      },
      {
        "date": "2021-07-21T11:39:23.747000",
        "db": "NVD",
        "id": "CVE-2019-17006"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "161916"
      }
    ],
    "trust": 0.1
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Network\u00a0Security\u00a0Services\u00a0 Vulnerability for inadequate validation of data reliability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-016070"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "arbitrary",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "155889"
      }
    ],
    "trust": 0.1
  }
}