5.9
MEDIUM
CVE-2020-1971
OpenSSL EDIPARTYNAME Name Comparison Vulnerability
Description

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).

INFO

Published Date :

Dec. 8, 2020, 4:15 p.m.

Last Modified :

June 21, 2024, 7:15 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

3.6

Exploitability Score :

2.2
Public PoC/Exploit Available at Github

CVE-2020-1971 has a 17 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2020-1971 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Oracle business_intelligence
2 Oracle mysql
3 Oracle peoplesoft_enterprise_peopletools
4 Oracle enterprise_manager_ops_center
5 Oracle jd_edwards_enterpriseone_tools
6 Oracle communications_diameter_intelligence_hub
7 Oracle essbase
8 Oracle http_server
9 Oracle enterprise_manager_base_platform
10 Oracle graalvm
11 Oracle communications_cloud_native_core_network_function_cloud_native_environment
12 Oracle mysql_server
13 Oracle communications_session_border_controller
14 Oracle enterprise_communications_broker
15 Oracle enterprise_session_border_controller
16 Oracle enterprise_manager_for_storage_management
17 Oracle jd_edwards_world_security
18 Oracle api_gateway
19 Oracle communications_session_router
20 Oracle communications_unified_session_manager
21 Oracle communications_subscriber-aware_load_balancer
1 Netapp active_iq_unified_manager
2 Netapp hci_management_node
3 Netapp solidfire
4 Netapp oncommand_insight
5 Netapp oncommand_workflow_automation
6 Netapp snapcenter
7 Netapp e-series_santricity_os_controller
8 Netapp plug-in_for_symantec_netbackup
9 Netapp hci_storage_node
10 Netapp clustered_data_ontap_antivirus_connector
11 Netapp data_ontap
12 Netapp santricity_smi-s_provider
13 Netapp hci_compute_node
14 Netapp manageability_software_development_kit
15 Netapp aff_a250_firmware
16 Netapp ef600a_firmware
17 Netapp ef600a
18 Netapp aff_a250
1 Tenable log_correlation_engine
2 Tenable nessus_network_monitor
1 Fedoraproject fedora
1 Debian debian_linux
1 Openssl openssl
1 Siemens sinec_infrastructure_network_services
1 Nodejs node.js
: Total Affected Vendor : 8 | Products : 46
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2020-1971.

URL Resource
http://www.openwall.com/lists/oss-security/2021/09/14/2 Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Third Party Advisory
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676 Third Party Advisory
https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc Third Party Advisory
https://security.gentoo.org/glsa/202012-13 Third Party Advisory
https://security.netapp.com/advisory/ntap-20201218-0005/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20210513-0002/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
https://www.debian.org/security/2020/dsa-4807 Third Party Advisory
https://www.openssl.org/news/secadv/20201208.txt Vendor Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory
https://www.tenable.com/security/tns-2020-11 Third Party Advisory
https://www.tenable.com/security/tns-2021-09 Third Party Advisory
https://www.tenable.com/security/tns-2021-10 Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
juwisnie/AZDevops-TrivyScan-Pipe

Based in https://github.com/arindam0310018/04-Apr-2022-DevOps__Scan-Images-In-ACR-Using-Trivy

Dockerfile HTML

Updated: 2 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 19, 2024, 3:48 p.m. This repo has been linked 19 different CVEs too.
Profile Photo
fredrkl/trivy-demo

Demo repository showcasing some of the possibilities of Aqua Trivy.

cncf-demo trivy

Dockerfile Shell

Updated: 1 year, 3 months ago
0 stars 0 fork 0 watcher
Born at : May 6, 2023, 9:42 a.m. This repo has been linked 27 different CVEs too.
Profile Photo
chnzzh/OpenSSL-CVE-lib

None

Updated: 2 months, 2 weeks ago
5 stars 0 fork 0 watcher
Born at : Feb. 23, 2023, 5:42 a.m. This repo has been linked 455 different CVEs too.
Profile Photo
vincent-deng/veracode-container-security-finding-parser

Map Vulnerabilities into Different Layers of the Container Image

Python

Updated: 1 year, 10 months ago
1 stars 0 fork 0 watcher
Born at : Oct. 5, 2022, 12:07 p.m. This repo has been linked 1276 different CVEs too.
Profile Photo
thecyberbaby/Trivy-by-AquaSecurity

A security framework by Aquasecurity

Updated: 2 years, 4 months ago
0 stars 0 fork 0 watcher
Born at : June 22, 2022, 10:40 a.m. This repo has been linked 16 different CVEs too.
Profile Photo
soosmile/POC

None

Updated: 4 months, 3 weeks ago
8 stars 1 fork 1 watcher
Born at : June 21, 2022, 7:45 a.m. This repo has been linked 943 different CVEs too.
Profile Photo
arindam0310018/04-Apr-2022-DevOps__Scan-Images-In-ACR-Using-Trivy

DEVOPS + ACR + TRIVY

azure azurecontainerregistry devops devops-pipeline powershell

Dockerfile HTML

Updated: 9 months, 1 week ago
5 stars 8 fork 8 watcher
Born at : April 4, 2022, 1:59 p.m. This repo has been linked 19 different CVEs too.
Profile Photo
fdl66/openssl-1.0.2u-fix-cve

本项目旨在解决openssl1.0.2u的漏洞问题。（1.0.2官方不在维护，所以，相关的漏洞修复代码都已经闭源，此处是从相近版本合入的代码， 源码来源：https://github.com/openssl/openssl/tree/OpenSSL_1_0_2u）

Shell C++ C Batchfile Perl DIGITAL Command Language Makefile Assembly XS M4

Updated: 3 months, 3 weeks ago
10 stars 4 fork 4 watcher
Born at : April 3, 2022, 12:51 p.m. This repo has been linked 9 different CVEs too.
Profile Photo
jntass/TASSL-1.1.1k

此仓库已停止维护，请移步https://github.com/jntass/TASSL-1.1.1

Perl DIGITAL Command Language C Shell Assembly M4 eC Python C++ sed

Updated: 8 months, 2 weeks ago
54 stars 16 fork 16 watcher
Born at : Nov. 24, 2021, 6:39 a.m. This repo has been linked 13 different CVEs too.
Profile Photo
vinamra28/tekton-image-scan-trivy

None

Go

Updated: 3 years, 1 month ago
0 stars 0 fork 0 watcher
Born at : Sept. 26, 2021, 12:33 p.m. This repo has been linked 17 different CVEs too.
Profile Photo
developer3000S/PoC-in-GitHub

None

Updated: 8 months, 2 weeks ago
33 stars 3 fork 3 watcher
Born at : March 12, 2021, 12:22 p.m. This repo has been linked 1063 different CVEs too.
Profile Photo
developer-guy/image-scanning-using-trivy-as-go-library

Demonstrate how you can use image scanner called Trivy as a golang library

Go

Updated: 2 months, 3 weeks ago
23 stars 4 fork 4 watcher
Born at : Feb. 7, 2021, 11:02 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
stevechanieee/-5-OpenSSL_Versioning

Cyber-Physical Supply Chain Transparency: Validating Versioning of Bundled Components, such as OpenSSL

openssl

Updated: 3 years, 9 months ago
0 stars 0 fork 0 watcher
Born at : Jan. 31, 2021, 8 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
hectorgie/PoC-in-GitHub

None

Updated: 1 year, 3 months ago
17 stars 10 fork 10 watcher
Born at : Jan. 2, 2021, 10:19 p.m. This repo has been linked 1050 different CVEs too.
Profile Photo
scott-leung/tools

工具库-置放一些常用工具或脚本

Python

Updated: 3 years, 11 months ago
0 stars 0 fork 0 watcher
Born at : Dec. 14, 2020, 3:17 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2020-1971 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2020-1971 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    Jun. 21, 2024

    Action Type Old Value New Value
    Added Reference OpenSSL Software Foundation https://security.netapp.com/advisory/ntap-20240621-0006/ [No types assigned]
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920 [No types assigned]
    Added Reference OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e [No types assigned]
    Added Reference OpenSSL Software Foundation https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/ [No types assigned]
    Added Reference OpenSSL Software Foundation https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E [No types assigned]
    Added Reference OpenSSL Software Foundation https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/ [No types assigned]
    Added Reference OpenSSL Software Foundation https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E [No types assigned]
    Removed Reference OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e
    Removed Reference OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f960d81215ebf3f65e03d4d5d857fb9b666d6920
    Removed Reference OpenSSL Software Foundation https://lists.fedoraproject.org/archives/list/[email protected]/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/
    Removed Reference OpenSSL Software Foundation https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143@%3Ccommits.pulsar.apache.org%3E
    Removed Reference OpenSSL Software Foundation https://lists.fedoraproject.org/archives/list/[email protected]/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/
    Removed Reference OpenSSL Software Foundation https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c@%3Cdev.tomcat.apache.org%3E
  • Reanalysis by [email protected]

    Aug. 29, 2022

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* versions from (including) 10.0.0 up to (including) 10.12.0 *cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* versions from (including) 10.13.0 up to (excluding) 10.23.1 *cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* versions from (including) 12.0.0 up to (including) 12.12.0 *cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* versions from (including) 12.13.0 up to (excluding) 12.20.1 *cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* versions from (including) 14.0.0 up to (including) 14.14.0 *cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* versions from (including) 14.15.0 up to (excluding) 14.15.4 *cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* versions from (including) 15.0.0 up to (excluding) 15.5.0
  • Modified Analysis by [email protected]

    May. 12, 2022

    Action Type Old Value New Value
    Changed Reference Type https://www.oracle.com/security-alerts/cpuapr2022.html No Types Assigned https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_unified_session_manager:scz8.2.5:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.3 *cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* versions up to (including) 8.0.22 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions up to (including) 5.7.32 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions from (including) 8.0.15 up to (including) 8.0.22 *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* OR *cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* versions from (including) 8.0.0 up to (including) 8.1.0 *cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* versions from (including) 8.2.0 up to (including) 8.2.3 *cpe:2.3:a:oracle:communications_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_unified_session_manager:scz8.2.5:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.3 *cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* versions up to (including) 8.0.22 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions up to (including) 5.7.32 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions from (including) 8.0.15 up to (including) 8.0.22 *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Apr. 20, 2022

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpuapr2022.html [No Types Assigned]
  • Modified Analysis by [email protected]

    Apr. 06, 2022

    Action Type Old Value New Value
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Third Party Advisory
    Changed Reference Type https://www.oracle.com/security-alerts/cpuoct2021.html No Types Assigned https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (including) 1.0.2w *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (including) 1.1.1h OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (excluding) 1.0.2x *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (excluding) 1.1.1i
    Changed CPE Configuration OR *cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_unified_session_manager:scz8.2.5:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.3 *cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* versions up to (including) 8.0.22 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions up to (including) 5.7.32 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions from (including) 8.0.15 up to (including) 8.0.22 *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* OR *cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_unified_session_manager:scz8.2.5:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.3 *cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* versions up to (including) 8.0.22 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions up to (including) 5.7.32 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions from (including) 8.0.15 up to (including) 8.0.22 *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.1.1
  • CVE Modified by [email protected]

    Mar. 10, 2022

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 20, 2021

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpuoct2021.html [No Types Assigned]
  • Modified Analysis by [email protected]

    Sep. 16, 2021

    Action Type Old Value New Value
    Changed Reference Type http://www.openwall.com/lists/oss-security/2021/09/14/2 No Types Assigned http://www.openwall.com/lists/oss-security/2021/09/14/2 Mailing List, Third Party Advisory
    Changed Reference Type https://security.netapp.com/advisory/ntap-20210513-0002/ No Types Assigned https://security.netapp.com/advisory/ntap-20210513-0002/ Third Party Advisory
    Changed Reference Type https://www.oracle.com//security-alerts/cpujul2021.html No Types Assigned https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
    Changed Reference Type https://www.oracle.com/security-alerts/cpuApr2021.html No Types Assigned https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory
    Changed Reference Type https://www.tenable.com/security/tns-2021-09 No Types Assigned https://www.tenable.com/security/tns-2021-09 Third Party Advisory
    Changed Reference Type https://www.tenable.com/security/tns-2021-10 No Types Assigned https://www.tenable.com/security/tns-2021-10 Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* versions up to (including) 8.0.22 OR *cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:communications_unified_session_manager:scz8.2.5:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* *cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.5.3 *cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* versions up to (including) 8.0.22 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions up to (including) 5.7.32 *cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* versions from (including) 8.0.15 up to (including) 8.0.22 *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
    Changed CPE Configuration OR *cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:* *cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (including) 11.60.3 *cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* *cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* *cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* OR *cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* *cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* *cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:* *cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (including) 11.60.3 *cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* *cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* *cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.9 *cpe:2.3:a:tenable:nessus_network_monitor:*:*:*:*:*:*:*:* versions up to (excluding) 5.13.1
  • CVE Modified by [email protected]

    Sep. 15, 2021

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2021/09/14/2 [No Types Assigned]
  • CVE Modified by [email protected]

    Jul. 20, 2021

    Action Type Old Value New Value
    Added Reference https://www.oracle.com//security-alerts/cpujul2021.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 14, 2021

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpuApr2021.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 02, 2021

    Action Type Old Value New Value
    Added Reference https://www.tenable.com/security/tns-2021-10 [No Types Assigned]
  • CVE Modified by [email protected]

    May. 13, 2021

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20210513-0002/ [No Types Assigned]
  • CVE Modified by [email protected]

    May. 11, 2021

    Action Type Old Value New Value
    Added Reference https://www.tenable.com/security/tns-2021-09 [No Types Assigned]
  • Modified Analysis by [email protected]

    Feb. 15, 2021

    Action Type Old Value New Value
    Changed Reference Type https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676 No Types Assigned https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676 Third Party Advisory
    Changed Reference Type https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c@%3Cdev.tomcat.apache.org%3E No Types Assigned https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c@%3Cdev.tomcat.apache.org%3E Mailing List, Third Party Advisory
    Changed Reference Type https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143@%3Ccommits.pulsar.apache.org%3E No Types Assigned https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143@%3Ccommits.pulsar.apache.org%3E Third Party Advisory
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html Third Party Advisory https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html Mailing List, Third Party Advisory
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html Third Party Advisory https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html Mailing List, Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/ Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/ Third Party Advisory
    Changed Reference Type https://security.gentoo.org/glsa/202012-13 No Types Assigned https://security.gentoo.org/glsa/202012-13 Third Party Advisory
    Changed Reference Type https://security.netapp.com/advisory/ntap-20201218-0005/ No Types Assigned https://security.netapp.com/advisory/ntap-20201218-0005/ Third Party Advisory
    Changed Reference Type https://www.oracle.com/security-alerts/cpujan2021.html No Types Assigned https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
    Changed Reference Type https://www.tenable.com/security/tns-2020-11 No Types Assigned https://www.tenable.com/security/tns-2020-11 Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:* *cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* versions up to (including) 8.0.22
    Added CPE Configuration OR *cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:* *cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (including) 11.60.3 *cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* *cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* *cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:ef600a_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:ef600a:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Feb. 07, 2021

    Action Type Old Value New Value
    Added Reference https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c@%3Cdev.tomcat.apache.org%3E [No Types Assigned]
  • CVE Modified by [email protected]

    Jan. 20, 2021

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpujan2021.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jan. 18, 2021

    Action Type Old Value New Value
    Added Reference https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 23, 2020

    Action Type Old Value New Value
    Added Reference https://security.gentoo.org/glsa/202012-13 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 21, 2020

    Action Type Old Value New Value
    Added Reference https://www.tenable.com/security/tns-2020-11 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 21, 2020

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/ [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 18, 2020

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20201218-0005/ [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 16, 2020

    Action Type Old Value New Value
    Added Reference https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143@%3Ccommits.pulsar.apache.org%3E [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 16, 2020

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/ [No Types Assigned]
  • Modified Analysis by [email protected]

    Dec. 15, 2020

    Action Type Old Value New Value
    Removed CVSS V2 NIST (AV:N/AC:L/Au:N/C:N/I:N/A:P)
    Added CVSS V2 NIST (AV:N/AC:M/Au:N/C:N/I:N/A:P)
    Removed CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    Added CVSS V3.1 NIST AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html No Types Assigned https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html Third Party Advisory
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html No Types Assigned https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* OR *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Dec. 14, 2020

    Action Type Old Value New Value
    Added Reference https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html [No Types Assigned]
    Added Reference https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html [No Types Assigned]
  • Initial Analysis by [email protected]

    Dec. 10, 2020

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:N/AC:L/Au:N/C:N/I:N/A:P)
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    Changed Reference Type https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e No Types Assigned https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e Broken Link
    Changed Reference Type https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f960d81215ebf3f65e03d4d5d857fb9b666d6920 No Types Assigned https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f960d81215ebf3f65e03d4d5d857fb9b666d6920 Patch, Vendor Advisory
    Changed Reference Type https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc No Types Assigned https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2020/dsa-4807 No Types Assigned https://www.debian.org/security/2020/dsa-4807 Third Party Advisory
    Changed Reference Type https://www.openssl.org/news/secadv/20201208.txt No Types Assigned https://www.openssl.org/news/secadv/20201208.txt Vendor Advisory
    Added CWE NIST CWE-476
    Added CPE Configuration OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (including) 1.0.2w *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (including) 1.1.1h
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Dec. 10, 2020

    Action Type Old Value New Value
    Added Reference https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 09, 2020

    Action Type Old Value New Value
    Added Reference https://www.debian.org/security/2020/dsa-4807 [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2020-1971 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2020-1971 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.44 }} -0.02%

score

0.75246

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: