{"cves":[{"id":"CVE-2020-9481","published":"2020-04-27T22:15:00","updated_at":"2025-08-26T12:27:14.433352+00:00","description":"\nApache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable\nto a HTTP/2 slow read attack.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://lists.apache.org/thread.html/rcb8bae0b289d71d18a3220be256c1dfcc4d9ab49d2d6e07d1eac7c9d%40%3Cannounce.trafficserver.apache.org%3E","https://www.cve.org/CVERecord?id=CVE-2020-9481"],"bugs":[""],"patches":{"trafficserver":[]},"tags":{},"packages":[{"name":"trafficserver","source":"https://ubuntu.com/security/cve?package=trafficserver","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=trafficserver","debian":"https://tracker.debian.org/pkg/trafficserver","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"8.0.7+ds-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-7067","published":"2020-04-27T21:15:00","updated_at":"2025-08-25T23:28:55.242985+00:00","description":"\nIn PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below\n7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode()\nfunction can be made to access locations past the allocated memory, due to\nerroneously using signed numbers as array indexes.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"only an issue when CHARSET_EBCDIC is defined, which isn't the\ncase on any Ubuntu platforms."}],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2020-7067"],"bugs":["https://bugs.php.net/79465"],"patches":{"php5":[],"php7.0":[],"php7.2":[],"php7.3":[],"php7.4":["upstream: http://git.php.net/?p=php-src.git;a=commit;h=9d6bf8221b05f86ce5875832f0f646c4c1f218be"]},"tags":{},"packages":[{"name":"php5","source":"https://ubuntu.com/security/cve?package=php5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=php5","debian":"https://tracker.debian.org/pkg/php5","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"php7.0","source":"https://ubuntu.com/security/cve?package=php7.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=php7.0","debian":"https://tracker.debian.org/pkg/php7.0","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"php7.2","source":"https://ubuntu.com/security/cve?package=php7.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=php7.2","debian":"https://tracker.debian.org/pkg/php7.2","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"php7.3","source":"https://ubuntu.com/security/cve?package=php7.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=php7.3","debian":"https://tracker.debian.org/pkg/php7.3","statuses":[{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"7.3.17","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"php7.4","source":"https://ubuntu.com/security/cve?package=php7.4","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=php7.4","debian":"https://tracker.debian.org/pkg/php7.4","statuses":[{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"7.4.5","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-1722","published":"2020-04-27T21:15:00","updated_at":"2025-07-11T07:43:44.143799+00:00","description":"\nA flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a\nvery long password (>= 1,000,000 characters) to the server, the password\nhashing process could exhaust memory and CPU leading to a denial of service\nand the website becoming unresponsive. The highest threat from this\nvulnerability is to system availability.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://pagure.io/freeipa/issue/8268","https://bugzilla.redhat.com/show_bug.cgi?id=1793071","https://access.redhat.com/security/cve/CVE-2020-1722","https://www.cve.org/CVERecord?id=CVE-2020-1722"],"bugs":[""],"patches":{"freeipa":[]},"tags":{},"packages":[{"name":"freeipa","source":"https://ubuntu.com/security/cve?package=freeipa","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=freeipa","debian":"https://tracker.debian.org/pkg/freeipa","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-11869","published":"2020-04-27T19:15:00","updated_at":"2025-08-25T23:18:08.814662+00:00","description":"\nAn integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it\nimplemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine\nin hw/display/ati-2d.c while handling MMIO write operations through the\nati_mm_write() callback. A malicious guest could abuse this flaw to crash\nthe QEMU process, resulting in a denial of service.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":3.3,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.openwall.com/lists/oss-security/2020/04/24/2","https://ubuntu.com/security/notices/USN-4372-1","https://www.cve.org/CVERecord?id=CVE-2020-11869"],"bugs":[""],"patches":{"qemu-kvm":[],"qemu":["upstream: https://git.qemu.org/?p=qemu.git;a=commit;h=ac2071c3791b67fc7af78b8ceb320c01ca1b5df7"]},"tags":{},"packages":[{"name":"qemu","source":"https://ubuntu.com/security/cve?package=qemu","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu","debian":"https://tracker.debian.org/pkg/qemu","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1:4.2-3ubuntu6.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"qemu-kvm","source":"https://ubuntu.com/security/cve?package=qemu-kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu-kvm","debian":"https://tracker.debian.org/pkg/qemu-kvm","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4372-1"],"notices":[{"id":"USN-4372-1","title":"QEMU vulnerabilities","summary":"Several security issues were fixed in QEMU.\n","instructions":"After a standard system update you need to restart all QEMU virtual\nmachines to make all the necessary changes.\n","references":[],"published":"2020-05-21T17:08:15.742200","description":"It was discovered that QEMU incorrectly handled bochs-display devices. A\nlocal attacker in a guest could use this to cause a denial of service or\npossibly execute arbitrary code in the host. This issue only affected\nUbuntu 19.10. (CVE-2019-15034)\n\nIt was discovered that QEMU incorrectly handled memory during certain VNC\noperations. A remote attacker could possibly use this issue to cause QEMU\nto consume resources, resulting in a denial of service. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10.\n(CVE-2019-20382)\n\nIt was discovered that QEMU incorrectly generated QEMU Pointer\nAuthentication signatures on ARM. A local attacker could possibly use this\nissue to bypass PAuth. This issue only affected Ubuntu 19.10.\n(CVE-2020-10702)\n\nZiming Zhang discovered that QEMU incorrectly handled ATI VGA emulation. A\nlocal attacker in a guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. This issue only affected Ubuntu 20.04\nLTS. (CVE-2020-11869)\n\nAviv Sasson discovered that QEMU incorrectly handled Slirp networking. A\nremote attacker could use this issue to cause QEMU to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10.\n(CVE-2020-1983)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"qemu","version":"1:2.11+dfsg-1ubuntu7.26","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-block-extra","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-guest-agent","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-kvm","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-system","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-system-arm","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-system-common","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-system-mips","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-system-misc","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-system-ppc","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-system-s390x","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-system-sparc","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-system-x86","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-user","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-user-binfmt","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-user-static","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"},{"name":"qemu-utils","version":"1:2.11+dfsg-1ubuntu7.26","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.26","pocket":"security"}],"eoan":[{"name":"qemu","version":"1:4.0+dfsg-0ubuntu9.6","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-block-extra","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-guest-agent","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-kvm","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-arm","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-common","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-data","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-gui","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-mips","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-misc","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-ppc","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-s390x","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-sparc","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-system-x86","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-user","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-user-binfmt","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-user-static","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"},{"name":"qemu-utils","version":"1:4.0+dfsg-0ubuntu9.6","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.0+dfsg-0ubuntu9.6"}],"focal":[{"name":"qemu","version":"1:4.2-3ubuntu6.1","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-block-extra","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-guest-agent","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-kvm","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-arm","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-common","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-data","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-gui","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-mips","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-misc","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-ppc","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-s390x","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-sparc","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-x86","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-x86-microvm","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-system-x86-xen","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-user","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-user-binfmt","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-user-static","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"},{"name":"qemu-utils","version":"1:4.2-3ubuntu6.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.1","pocket":"security"}],"xenial":[{"name":"qemu","version":"1:2.5+dfsg-5ubuntu10.44","description":"Machine emulator and virtualizer","is_source":true},{"name":"qemu","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-block-extra","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-guest-agent","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-kvm","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system-aarch64","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system-arm","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system-common","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system-mips","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system-misc","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system-ppc","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system-s390x","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system-sparc","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-system-x86","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-user","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-user-binfmt","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-user-static","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"},{"name":"qemu-utils","version":"1:2.5+dfsg-5ubuntu10.44","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/qemu","version_link":"https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.44","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2019-15034","CVE-2019-20382","CVE-2020-10702","CVE-2020-11869","CVE-2020-1983"]}]},{"id":"CVE-2020-12279","published":"2020-04-27T17:15:00","updated_at":"2025-08-26T12:18:59.224745+00:00","description":"\nAn issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0.\ncheckout.c mishandles equivalent filenames that exist because of NTFS short\nnames. This may allow remote code execution when cloning a repository. This\nissue is similar to CVE-2019-1353.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733v","https://github.com/libgit2/libgit2/releases/tag/v0.28.4","https://github.com/libgit2/libgit2/releases/tag/v0.99.0","https://ubuntu.com/security/notices/USN-6678-1","https://www.cve.org/CVERecord?id=CVE-2020-12279"],"bugs":[""],"patches":{"libgit2":["upstream: https://github.com/libgit2/libgit2/commit/64c612cc3e25eff5fb02c59ef5a66ba7a14751e4"]},"tags":{},"packages":[{"name":"libgit2","source":"https://ubuntu.com/security/cve?package=libgit2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libgit2","debian":"https://tracker.debian.org/pkg/libgit2","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"0.28.4+dfsg.1-2","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"1.1.0+dfsg.1-4.1build1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1","component":null,"pocket":"esm-apps"},{"release_codename":"upstream","status":"released","description":"0.28.4,0.99.0","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"0.24.1-2ubuntu0.2+esm2","component":null,"pocket":"esm-apps"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-6678-1"],"notices":[{"id":"USN-6678-1","title":"libgit2 vulnerabilities","summary":"Several security issues were fixed in libgit2.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-03-05T18:46:35.357865","description":"It was discovered that libgit2 mishandled equivalent filenames on NTFS\npartitions. If a user or automated system were tricked into cloning a\nspecially crafted repository, an attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2020-12278, CVE-2020-12279)\n\nIt was discovered that libgit2 did not perform certificate checking by\ndefault. An attacker could possibly use this issue to perform a\nmachine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-22742)\n\nIt was discovered that libgit2 could be made to run into an infinite loop.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 23.10. (CVE-2024-24575)\n\nIt was discovered that libgit2 did not properly manage memory. An attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. (CVE-2024-24577)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"libgit2","version":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-26","version":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":null,"pocket":"esm-apps"},{"name":"libgit2-dev","version":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"libgit2","version":"0.28.4+dfsg.1-2ubuntu0.1","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-28","version":"0.28.4+dfsg.1-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/0.28.4+dfsg.1-2ubuntu0.1","pocket":"security"},{"name":"libgit2-dev","version":"0.28.4+dfsg.1-2ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/0.28.4+dfsg.1-2ubuntu0.1","pocket":"security"}],"jammy":[{"name":"libgit2","version":"1.1.0+dfsg.1-4.1ubuntu0.1","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-1.1","version":"1.1.0+dfsg.1-4.1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.1.0+dfsg.1-4.1ubuntu0.1","pocket":"security"},{"name":"libgit2-dev","version":"1.1.0+dfsg.1-4.1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.1.0+dfsg.1-4.1ubuntu0.1","pocket":"security"},{"name":"libgit2-fixtures","version":"1.1.0+dfsg.1-4.1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.1.0+dfsg.1-4.1ubuntu0.1","pocket":"security"}],"mantic":[{"name":"libgit2","version":"1.5.1+ds-1ubuntu1.1","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-1.5","version":"1.5.1+ds-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.5.1+ds-1ubuntu1.1","pocket":"security"},{"name":"libgit2-dev","version":"1.5.1+ds-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.5.1+ds-1ubuntu1.1","pocket":"security"},{"name":"libgit2-fixtures","version":"1.5.1+ds-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.5.1+ds-1ubuntu1.1","pocket":"security"}],"xenial":[{"name":"libgit2","version":"0.24.1-2ubuntu0.2+esm2","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-24","version":"0.24.1-2ubuntu0.2+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":null,"pocket":"esm-apps"},{"name":"libgit2-dev","version":"0.24.1-2ubuntu0.2+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2024-24575","CVE-2024-24577","CVE-2020-12278","CVE-2023-22742","CVE-2020-12279"]}]},{"id":"CVE-2020-12278","published":"2020-04-27T17:15:00","updated_at":"2025-08-26T12:18:59.224745+00:00","description":"\nAn issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0.\npath.c mishandles equivalent filenames that exist because of NTFS Alternate\nData Streams. This may allow remote code execution when cloning a\nrepository. This issue is similar to CVE-2019-1352.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://github.com/git/git/security/advisories/GHSA-5wph-8frv-58vj","https://github.com/libgit2/libgit2/releases/tag/v0.28.4","https://github.com/libgit2/libgit2/releases/tag/v0.99.0","https://ubuntu.com/security/notices/USN-6678-1","https://www.cve.org/CVERecord?id=CVE-2020-12278"],"bugs":[""],"patches":{"libgit2":["upstream: https://github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776ed01","upstream: https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300cb"]},"tags":{},"packages":[{"name":"libgit2","source":"https://ubuntu.com/security/cve?package=libgit2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libgit2","debian":"https://tracker.debian.org/pkg/libgit2","statuses":[{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"0.28.4+dfsg.1-2","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"0.24.1-2ubuntu0.2+esm2","component":null,"pocket":"esm-apps"},{"release_codename":"jammy","status":"not-affected","description":"1.1.0+dfsg.1-4.1build1","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1","component":null,"pocket":"esm-apps"},{"release_codename":"upstream","status":"released","description":"0.28.4,0.99.0","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-6678-1"],"notices":[{"id":"USN-6678-1","title":"libgit2 vulnerabilities","summary":"Several security issues were fixed in libgit2.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2024-03-05T18:46:35.357865","description":"It was discovered that libgit2 mishandled equivalent filenames on NTFS\npartitions. If a user or automated system were tricked into cloning a\nspecially crafted repository, an attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2020-12278, CVE-2020-12279)\n\nIt was discovered that libgit2 did not perform certificate checking by\ndefault. An attacker could possibly use this issue to perform a\nmachine-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-22742)\n\nIt was discovered that libgit2 could be made to run into an infinite loop.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 23.10. (CVE-2024-24575)\n\nIt was discovered that libgit2 did not properly manage memory. An attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. (CVE-2024-24577)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"libgit2","version":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-26","version":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":null,"pocket":"esm-apps"},{"name":"libgit2-dev","version":"0.26.0+dfsg.1-1.1ubuntu0.2+esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"libgit2","version":"0.28.4+dfsg.1-2ubuntu0.1","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-28","version":"0.28.4+dfsg.1-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/0.28.4+dfsg.1-2ubuntu0.1","pocket":"security"},{"name":"libgit2-dev","version":"0.28.4+dfsg.1-2ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/0.28.4+dfsg.1-2ubuntu0.1","pocket":"security"}],"jammy":[{"name":"libgit2","version":"1.1.0+dfsg.1-4.1ubuntu0.1","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-1.1","version":"1.1.0+dfsg.1-4.1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.1.0+dfsg.1-4.1ubuntu0.1","pocket":"security"},{"name":"libgit2-dev","version":"1.1.0+dfsg.1-4.1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.1.0+dfsg.1-4.1ubuntu0.1","pocket":"security"},{"name":"libgit2-fixtures","version":"1.1.0+dfsg.1-4.1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.1.0+dfsg.1-4.1ubuntu0.1","pocket":"security"}],"mantic":[{"name":"libgit2","version":"1.5.1+ds-1ubuntu1.1","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-1.5","version":"1.5.1+ds-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.5.1+ds-1ubuntu1.1","pocket":"security"},{"name":"libgit2-dev","version":"1.5.1+ds-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.5.1+ds-1ubuntu1.1","pocket":"security"},{"name":"libgit2-fixtures","version":"1.5.1+ds-1ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":"https://launchpad.net/ubuntu/+source/libgit2/1.5.1+ds-1ubuntu1.1","pocket":"security"}],"xenial":[{"name":"libgit2","version":"0.24.1-2ubuntu0.2+esm2","description":"Portable C implementation of the Git core methods library","is_source":true},{"name":"libgit2-24","version":"0.24.1-2ubuntu0.2+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":null,"pocket":"esm-apps"},{"name":"libgit2-dev","version":"0.24.1-2ubuntu0.2+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/libgit2","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2024-24575","CVE-2024-24577","CVE-2020-12278","CVE-2023-22742","CVE-2020-12279"]}]},{"id":"CVE-2020-9488","published":"2020-04-27T16:15:00","updated_at":"2025-08-26T12:27:14.433352+00:00","description":"\nImproper validation of certificate with host mismatch in Apache Log4j SMTP\nappender. This could allow an SMTPS connection to be intercepted by a\nman-in-the-middle attack which could leak any log messages sent through\nthat appender. Fixed in Apache Log4j 2.12.3 and 2.13.1","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.openwall.com/lists/oss-security/2020/04/25/1","https://issues.apache.org/jira/browse/LOG4J2-2819","https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=6851b5083ef9610bae320bf07e1f24d2aa08851b (release-2.x)","https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=fb91a3d71e2f3dadad6fd1beb2ab857f44fe8bbb (master)","https://www.cve.org/CVERecord?id=CVE-2020-9488"],"bugs":[""],"patches":{"apache-log4j2":[]},"tags":{},"packages":[{"name":"apache-log4j2","source":"https://ubuntu.com/security/cve?package=apache-log4j2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=apache-log4j2","debian":"https://tracker.debian.org/pkg/apache-log4j2","statuses":[{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"2.16.0-0.20.04.1","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.13.2","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"2.13.3-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-11810","published":"2020-04-27T15:15:00","updated_at":"2025-08-25T23:18:08.814662+00:00","description":"\nAn issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can\ninject a data channel v2 (P_DATA_V2) packet using a victim's peer-id.\nNormally such packets are dropped, but if this packet arrives before the\ndata channel crypto parameters have been initialized, the victim's\nconnection will be dropped. This requires careful timing due to the small\ntime window (usually within a few seconds) between the victim client\nconnection starting and the server PUSH_REPLY response back to the client.\nThis attack will only work if Negotiable Cipher Parameters (NCP) is in use.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4933-1","https://www.cve.org/CVERecord?id=CVE-2020-11810"],"bugs":[""],"patches":{"openvpn":["upstream: https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab","upstream: https://github.com/OpenVPN/openvpn/commit/f7b318f811bb43c0d3aa7f337ec6242ed2c33881"]},"tags":{},"packages":[{"name":"openvpn","source":"https://ubuntu.com/security/cve?package=openvpn","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openvpn","debian":"https://tracker.debian.org/pkg/openvpn","statuses":[{"release_codename":"groovy","status":"not-affected","description":"2.4.9-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"2.5.1-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"2.4.4-2ubuntu1.5","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"2.4.7-1ubuntu2.20.04.2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.4.9-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]}],"notices_ids":["USN-4933-1"],"notices":[{"id":"USN-4933-1","title":"OpenVPN vulnerabilities","summary":"Several security issues were fixed in OpenVPN.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-05-04T11:59:09.119137","description":"It was discovered that OpenVPN incorrectly handled certain data channel v2\npackets. A remote attacker could possibly use this issue to inject packets\nusing a victim's peer-id. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-11810)\n\nIt was discovered that OpenVPN incorrectly handled deferred authentication.\nWhen a server is configured to use deferred authentication, a remote\nattacker could possibly use this issue to bypass authentication and access\ncontrol channel data. (CVE-2020-15078)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openvpn","version":"2.4.4-2ubuntu1.5","description":"virtual private network software","is_source":true},{"name":"openvpn","version":"2.4.4-2ubuntu1.5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openvpn","version_link":"https://launchpad.net/ubuntu/+source/openvpn/2.4.4-2ubuntu1.5","pocket":"security"}],"focal":[{"name":"openvpn","version":"2.4.7-1ubuntu2.20.04.2","description":"virtual private network software","is_source":true},{"name":"openvpn","version":"2.4.7-1ubuntu2.20.04.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openvpn","version_link":"https://launchpad.net/ubuntu/+source/openvpn/2.4.7-1ubuntu2.20.04.2","pocket":"security"}],"groovy":[{"name":"openvpn","version":"2.4.9-3ubuntu1.1","description":"virtual private network software","is_source":true},{"name":"openvpn","version":"2.4.9-3ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openvpn","version_link":"https://launchpad.net/ubuntu/+source/openvpn/2.4.9-3ubuntu1.1","pocket":"security"}],"hirsute":[{"name":"openvpn","version":"2.5.1-1ubuntu1.1","description":"virtual private network software","is_source":true},{"name":"openvpn","version":"2.5.1-1ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openvpn","version_link":"https://launchpad.net/ubuntu/+source/openvpn/2.5.1-1ubuntu1.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-15078","CVE-2020-11810"]}]},{"id":"CVE-2019-18823","published":"2020-04-27T15:15:00","updated_at":"2025-07-11T07:42:20.559517+00:00","description":"\nHTCondor up to and including stable series 8.8.6 and development series\n8.9.4 has Incorrect Access Control. It is possible to use a different\nauthentication method to submit a job than the administrator has specified.\nIf the administrator has configured the READ or WRITE methods to include\nCLAIMTOBE, then it is possible to impersonate another user to the\ncondor_schedd. (For example to submit or remove jobs)","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0001.html","https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0002.html","https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0003.html","https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0004.html","https://github.com/htcondor/htcondor/commit/95eaee86e7ad3852c17df46a1b8b193dabd1fd14","https://github.com/htcondor/htcondor/commit/07e33c8b14aa00e04d045d4d79c963db082a3129","https://github.com/htcondor/htcondor/commit/cbcb93695a932d511c1c7bd40aed1eabeff01d8d","https://github.com/htcondor/htcondor/commit/3916209123a8ef762b7a9cd84ca0cf8b2cd99716","https://github.com/htcondor/htcondor/commit/5c84c6f0b3db4eda1eec42c2c708069bb9393f0b","https://www.cve.org/CVERecord?id=CVE-2019-18823"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=963777"],"patches":{"condor":[]},"tags":{},"packages":[{"name":"condor","source":"https://ubuntu.com/security/cve?package=condor","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=condor","debian":"https://tracker.debian.org/pkg/condor","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-9489","published":"2020-04-27T14:15:00","updated_at":"2025-08-26T12:27:14.433352+00:00","description":"\nA carefully crafted or corrupt file may trigger a System.exit in Tika's\nOneNote Parser. Crafted or corrupted files can also cause out of memory\nerrors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser,\nSAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should\nupgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were\npartially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency\nto org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we\nupgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.openwall.com/lists/oss-security/2020/04/24/1","https://www.cve.org/CVERecord?id=CVE-2020-9489"],"bugs":[""],"patches":{"tika":[]},"tags":{},"packages":[{"name":"tika","source":"https://ubuntu.com/security/cve?package=tika","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tika","debian":"https://tracker.debian.org/pkg/tika","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"not feasible to fix","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"not feasible to fix","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"not feasible to fix","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"not feasible to fix","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"not feasible to fix","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"not feasible to fix","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"not feasible to fix","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-12272","published":"2020-04-27T14:15:00","updated_at":"2025-08-25T23:18:17.963374+00:00","description":"\nOpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication\nresults to provide false information about the domain that originated an\ne-mail message. This is caused by incorrect parsing and interpretation of\nSPF/DKIM authentication results, as demonstrated by the\nexample.net(.example.com substring.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://sourceforge.net/p/opendmarc/tickets/237/","https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf","https://ubuntu.com/security/notices/USN-6356-1","https://www.cve.org/CVERecord?id=CVE-2020-12272"],"bugs":[""],"patches":{"opendmarc":[]},"tags":{},"packages":[{"name":"opendmarc","source":"https://ubuntu.com/security/cve?package=opendmarc","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=opendmarc","debian":"https://tracker.debian.org/pkg/opendmarc","statuses":[{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"1.4.2-2","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1.3.1+dfsg-3ubuntu0.1~esm1","component":null,"pocket":"esm-apps"},{"release_codename":"jammy","status":"not-affected","description":"1.4.2-1","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1.3.2-7ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1.3.2-3ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.4.2","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"1.4.2-3","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"1.4.2-3","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"1.4.2-3","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"1.4.2-3","component":null,"pocket":"security"}]}],"notices_ids":["USN-6356-1"],"notices":[{"id":"USN-6356-1","title":"OpenDMARC vulnerabilities","summary":"Several security issues were fixed in OpenDMARC.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2023-09-11T12:47:12.207520","description":"Jianjun Chen, Vern Paxson and Jian Jiang discovered that OpenDMARC\nincorrectly handled certain inputs. If a user or an automated system were\ntricked into receiving crafted inputs, an attacker could possibly use this\nto falsify the domain of an e-mails origin. (CVE-2020-12272)\n\nPatrik Lantz discovered that OpenDMARC incorrectly handled certain inputs.\nIf a user or an automated system were tricked into opening a specially\ncrafted input file, a remote attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-12460)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"opendmarc","version":"1.3.2-3ubuntu0.2","description":"Open Source implementation of the DMARC specification","is_source":true},{"name":"libopendmarc-dev","version":"1.3.2-3ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":"https://launchpad.net/ubuntu/+source/opendmarc/1.3.2-3ubuntu0.2","pocket":"security"},{"name":"libopendmarc2","version":"1.3.2-3ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":"https://launchpad.net/ubuntu/+source/opendmarc/1.3.2-3ubuntu0.2","pocket":"security"},{"name":"opendmarc","version":"1.3.2-3ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":"https://launchpad.net/ubuntu/+source/opendmarc/1.3.2-3ubuntu0.2","pocket":"security"},{"name":"rddmarc","version":"1.3.2-3ubuntu0.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":"https://launchpad.net/ubuntu/+source/opendmarc/1.3.2-3ubuntu0.2","pocket":"security"}],"focal":[{"name":"opendmarc","version":"1.3.2-7ubuntu0.1","description":"Open Source implementation of the DMARC specification","is_source":true},{"name":"libopendmarc-dev","version":"1.3.2-7ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":"https://launchpad.net/ubuntu/+source/opendmarc/1.3.2-7ubuntu0.1","pocket":"security"},{"name":"libopendmarc2","version":"1.3.2-7ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":"https://launchpad.net/ubuntu/+source/opendmarc/1.3.2-7ubuntu0.1","pocket":"security"},{"name":"opendmarc","version":"1.3.2-7ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":"https://launchpad.net/ubuntu/+source/opendmarc/1.3.2-7ubuntu0.1","pocket":"security"}],"xenial":[{"name":"opendmarc","version":"1.3.1+dfsg-3ubuntu0.1~esm1","description":"Open Source implementation of the DMARC specification","is_source":true},{"name":"libopendmarc-dev","version":"1.3.1+dfsg-3ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":null,"pocket":"esm-apps"},{"name":"libopendmarc2","version":"1.3.1+dfsg-3ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":null,"pocket":"esm-apps"},{"name":"opendmarc","version":"1.3.1+dfsg-3ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":null,"pocket":"esm-apps"},{"name":"rddmarc","version":"1.3.1+dfsg-3ubuntu0.1~esm1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/opendmarc","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2020-12460","CVE-2020-12272"]}]},{"id":"CVE-2019-20790","published":"2020-04-27T14:15:00","updated_at":"2025-07-11T07:42:31.688561+00:00","description":"\nOpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2,\nallows attacks that bypass SPF and DMARC authentication in situations where\nthe HELO field is inconsistent with the MAIL FROM field.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816","https://sourceforge.net/p/opendmarc/tickets/235/","https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf","https://www.cve.org/CVERecord?id=CVE-2019-20790"],"bugs":[""],"patches":{"opendmarc":[]},"tags":{},"packages":[{"name":"opendmarc","source":"https://ubuntu.com/security/cve?package=opendmarc","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=opendmarc","debian":"https://tracker.debian.org/pkg/opendmarc","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-12052","published":"2020-04-27T13:15:00","updated_at":"2025-08-26T12:18:44.534607+00:00","description":"\nGrafana version < 6.7.3 is vulnerable for annotation popup XSS.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://community.grafana.com/t/release-notes-v6-7-x/27119","https://www.cve.org/CVERecord?id=CVE-2020-12052"],"bugs":[""],"patches":{"grafana":[]},"tags":{},"packages":[{"name":"grafana","source":"https://ubuntu.com/security/cve?package=grafana","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=grafana","debian":"https://tracker.debian.org/pkg/grafana","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-10997","published":"2020-04-27T13:15:00","updated_at":"2025-08-25T23:17:42.822257+00:00","description":"\nPercona XtraBackup before 2.4.20 unintentionally writes the command line to\nany resulting backup file output. This may include sensitive arguments\npassed at run time. In addition, when --history is passed at run time, this\ncommand line is also written to the PERCONA_SCHEMA.xtrabackup_history\ntable.","ubuntu_description":"","notes":[{"author":"rodrigo-zaiden","note":"issue introduced in version 2.4.11 in commit\nhttps://github.com/percona/percona-xtrabackup/commit/0b38ffc0f30"}],"codename":null,"priority":"low","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.percona.com/blog/2020/04/16/cve-2020-10997-percona-xtrabackup-information-disclosure-of-command-line-arguments/","https://www.cve.org/CVERecord?id=CVE-2020-10997"],"bugs":["https://jira.percona.com/browse/PXB-2142","https://jira.percona.com/browse/PXB-2145","https://jira.percona.com/browse/PXB-2152","https://jira.percona.com/browse/PXB-2154"],"patches":{"percona-xtrabackup":["upstream: https://github.com/percona/percona-xtrabackup/commit/4929726f1e0","upstream: https://github.com/percona/percona-xtrabackup/commit/c4d541da292","upstream: https://github.com/percona/percona-xtrabackup/commit/fbb2970439f","upstream: https://github.com/percona/percona-xtrabackup/commit/4a5a77103d8","upstream: https://github.com/percona/percona-xtrabackup/commit/7b33df69ffc","upstream: https://github.com/percona/percona-xtrabackup/commit/978c82409f1","upstream: https://github.com/percona/percona-xtrabackup/commit/c80d24f8152","upstream: https://github.com/percona/percona-xtrabackup/commit/0fed3fcf95b"]},"tags":{},"packages":[{"name":"percona-xtrabackup","source":"https://ubuntu.com/security/cve?package=percona-xtrabackup","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=percona-xtrabackup","debian":"https://tracker.debian.org/pkg/percona-xtrabackup","statuses":[{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.4.20, 8.0.11","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-10996","published":"2020-04-27T13:15:00","updated_at":"2026-03-11T19:47:11.580538+00:00","description":"\nAn issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A\nbundled script inadvertently sets a static transition_key for SST processes\nin place of the random key expected.","ubuntu_description":"","notes":[{"author":"john-breton","note":"Not introduced until 5.7.X, as such 5.6 isn't vulnerable.\n\nIntroduced in commit a8510605d99814fff1f91cc46e7bfb632d16ea7e,\nwhich our version of percona-xtradb-cluster-5.7 does not\nhave."}],"codename":null,"priority":"medium","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://jira.percona.com/browse/PXC-3117","https://www.percona.com/blog/2020/04/20/cve-2020-10996-percona-xtradb-cluster-sst-script-static-key/","https://www.percona.com/doc/percona-xtradb-cluster/LATEST/release-notes/Percona-XtraDB-Cluster-5.7.28-31.41.2.html","https://www.cve.org/CVERecord?id=CVE-2020-10996","https://github.com/percona/percona-xtradb-cluster/commit/a8510605d99814fff1f91cc46e7bfb632d16ea7e#diff-de444fd36807a8a5160fd8bf63dd1dc5e47f704b4beef352bf31c3fb62489398"],"bugs":[""],"patches":{"percona-xtradb-cluster-5.6":[],"percona-xtradb-cluster-5.7":[]},"tags":{},"packages":[{"name":"percona-xtradb-cluster-5.6","source":"https://ubuntu.com/security/cve?package=percona-xtradb-cluster-5.6","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=percona-xtradb-cluster-5.6","debian":"https://tracker.debian.org/pkg/percona-xtradb-cluster-5.6","statuses":[{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"percona-xtradb-cluster-5.7","source":"https://ubuntu.com/security/cve?package=percona-xtradb-cluster-5.7","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=percona-xtradb-cluster-5.7","debian":"https://tracker.debian.org/pkg/percona-xtradb-cluster-5.7","statuses":[{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"5.7.28.2","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-12268","published":"2020-04-27T02:15:00","updated_at":"2025-08-26T12:18:59.224745+00:00","description":"\njbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a\nheap-based buffer overflow.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20332","https://github.com/ArtifexSoftware/jbig2dec/commit/0726320a4b55078e9d8deb590e477d598b3da66e","https://github.com/ArtifexSoftware/jbig2dec/compare/0.17...0.18","https://ubuntu.com/security/notices/USN-5405-1","https://www.cve.org/CVERecord?id=CVE-2020-12268"],"bugs":[""],"patches":{"jbig2dec":[]},"tags":{},"packages":[{"name":"jbig2dec","source":"https://ubuntu.com/security/cve?package=jbig2dec","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jbig2dec","debian":"https://tracker.debian.org/pkg/jbig2dec","statuses":[{"release_codename":"impish","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"0.18-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"0.12+20150918-1ubuntu0.1+esm2","component":null,"pocket":"esm-infra"},{"release_codename":"kinetic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.18-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-5405-1"],"notices":[{"id":"USN-5405-1","title":"jbig2dec vulnerabilities","summary":"Several security issues were fixed in jbig2dec.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2022-05-05T21:11:41.982935","description":"It was discovered that jbig2dec incorrectly handled memory when parsing\ninvalid files. An attacker could use this issue to cause jbig2dec to crash,\nleading to a denial of service. (CVE-2017-9216)\n\nIt was discovered that jbig2dec incorrectly handled memory when processing\nuntrusted input. An attacker could use this issue to cause a denial of service,\nor possibly execute arbitrary code. (CVE-2020-12268)\n","is_hidden":false,"release_packages":{"xenial":[{"name":"jbig2dec","version":"0.12+20150918-1ubuntu0.1+esm2","description":"JBIG2 decoder library","is_source":true},{"name":"libjbig2dec0","version":"0.12+20150918-1ubuntu0.1+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/jbig2dec","version_link":null,"pocket":"esm-infra"},{"name":"jbig2dec","version":"0.12+20150918-1ubuntu0.1+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/jbig2dec","version_link":null,"pocket":"esm-infra"},{"name":"libjbig2dec0-dev","version":"0.12+20150918-1ubuntu0.1+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/jbig2dec","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2017-9216","CVE-2020-12268"]}]},{"id":"CVE-2020-12267","published":"2020-04-27T02:15:00","updated_at":"2025-08-25T23:18:17.963374+00:00","description":"\nsetMarkdown in Qt before 5.14.2 has a use-after-free related to\nQTextMarkdownImporter::insertBlock.","ubuntu_description":"","notes":[{"author":"leosilva","note":"QTextMarkdownImporter was added in version 5.13."}],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20450","https://codereview.qt-project.org/c/qt/qtbase/+/291706","https://codereview.qt-project.org/gitweb?p=qt%2Fqtbase.git;a=commit;h=7447e2b337f12b4d04935d0f30fc673e4327d5a0","https://www.cve.org/CVERecord?id=CVE-2020-12267"],"bugs":[""],"patches":{"qt4-x11":[],"qtbase-opensource-src":[]},"tags":{},"packages":[{"name":"qt4-x11","source":"https://ubuntu.com/security/cve?package=qt4-x11","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qt4-x11","debian":"https://tracker.debian.org/pkg/qt4-x11","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"qtbase-opensource-src","source":"https://ubuntu.com/security/cve?package=qtbase-opensource-src","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qtbase-opensource-src","debian":"https://tracker.debian.org/pkg/qtbase-opensource-src","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-12245","published":"2020-04-24T21:15:00","updated_at":"2025-08-26T12:18:59.224745+00:00","description":"\nGrafana before 6.7.3 allows table-panel XSS via column.title or\ncellLinkTooltip.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://github.com/grafana/grafana/pull/23816","https://community.grafana.com/t/release-notes-v6-7-x/27119","https://github.com/grafana/grafana/blob/master/CHANGELOG.md#673-2020-04-23","https://www.cve.org/CVERecord?id=CVE-2020-12245"],"bugs":[""],"patches":{"grafana":[]},"tags":{},"packages":[{"name":"grafana","source":"https://ubuntu.com/security/cve?package=grafana","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=grafana","debian":"https://tracker.debian.org/pkg/grafana","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-11013","published":"2020-04-24T20:15:00","updated_at":"2025-07-11T07:43:12.572023+00:00","description":"\nTheir is an information disclosure vulnerability in Helm from version 3.1.0\nand before version 3.2.0. `lookup` is a Helm template function introduced\nin Helm v3. It is able to lookup resources in the cluster to check for the\nexistence of specific resources and get details about them. This can be\nused as part of the process to render templates. The documented behavior of\n`helm template` states that it does not attach to a remote cluster.\nHowever, a the recently added `lookup` template function circumvents this\nrestriction and connects to the cluster even during `helm template` and\n`helm install|update|delete|rollback --dry-run`. The user is not notified\nof this behavior. Running `helm template` should not make calls to a\ncluster. This is different from `install`, which is presumed to have access\nto a cluster in order to load resources into Kubernetes. Helm 2 is\nunaffected by this vulnerability. A malicious chart author could inject a\n`lookup` into a chart that, when rendered through `helm template`, performs\nunannounced lookups against the cluster a user&#39;s `KUBECONFIG` file\npoints to. This information can then be disclosed via the output of `helm\ntemplate`. This issue has been fixed in Helm 3.2.0","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":8.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/helm/helm/releases/tag/v3.2.0","https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8","https://www.cve.org/CVERecord?id=CVE-2020-11013"],"bugs":[""],"patches":{"helm":[]},"tags":{},"packages":[{"name":"helm","source":"https://ubuntu.com/security/cve?package=helm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=helm","debian":"https://tracker.debian.org/pkg/helm","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"impish","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-12137","published":"2020-04-24T13:15:00","updated_at":"2025-08-25T23:18:17.963374+00:00","description":"\nGNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed\napplication/octet-stream MIME parts. This behavior may contribute to XSS\nattacks against list-archive visitors, because an HTTP reply from an\narchive web server may lack a MIME type, and a web browser may perform MIME\nsniffing, conclude that the MIME type should have been text/html, and\nexecute JavaScript code.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.openwall.com/lists/oss-security/2020/02/24/2","http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1801","http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS","http://www.openwall.com/lists/oss-security/2020/04/24/3","https://www.openwall.com/lists/oss-security/2020/02/24/3","https://ubuntu.com/security/notices/USN-4348-1","https://ubuntu.com/security/notices/USN-5121-2","https://www.cve.org/CVERecord?id=CVE-2020-12137"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=958930"],"patches":{"mailman":[]},"tags":{},"packages":[{"name":"mailman","source":"https://ubuntu.com/security/cve?package=mailman","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mailman","debian":"https://tracker.debian.org/pkg/mailman","statuses":[{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"1:2.1.29-1ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"1:2.1.26-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"1:2.1.20-1ubuntu0.4","component":null,"pocket":"security"}]}],"notices_ids":["USN-4348-1","USN-5121-2"],"notices":[{"id":"USN-4348-1","title":"Mailman vulnerabilities","summary":"Several security issues were fixed in Mailman.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2020-04-29T14:40:50.551321","description":"It was discovered that Mailman incorrectly handled certain inputs.\nAn attacker could possibly use this to issue execute arbitrary scripts\nor HTML. (CVE-2018-0618)\n\nIt was discovered that Mailman incorrectly handled certain inputs.\nAn attacker could possibly use this issue to display arbitrary text\non a web page. (CVE-2018-13796)\n\nIt was discovered that Mailman incorrectly handled certain files.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-12137)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"mailman","version":"1:2.1.26-1ubuntu0.1","description":"Web-based mailing list manager (legacy branch)","is_source":true},{"name":"mailman","version":"1:2.1.26-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mailman","version_link":"https://launchpad.net/ubuntu/+source/mailman/1:2.1.26-1ubuntu0.1","pocket":"security"}],"xenial":[{"name":"mailman","version":"1:2.1.20-1ubuntu0.4","description":"Powerful, web-based mailing list manager","is_source":true},{"name":"mailman","version":"1:2.1.20-1ubuntu0.4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mailman","version_link":"https://launchpad.net/ubuntu/+source/mailman/1:2.1.20-1ubuntu0.4","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2018-0618","CVE-2018-13796","CVE-2020-12137"]},{"id":"USN-5121-2","title":"Mailman vulnerabilities","summary":"Several security issues were fixed in Mailman.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-11-01T11:49:48.880119","description":"USN-5009-1 fixed vulnerabilities in Mailman. This update provides the\ncorresponding updates for Ubuntu 20.04 LTS. In addition, the following CVEs\nwere fixed:\n\nIt was discovered that Mailman allows arbitrary content injection. An attacker\ncould use this to inject malicious content. (CVE-2020-12108, CVE-2020-15011)\n\nIt was discovered that Mailman improperly sanitize the MIME content. An\nattacker could obtain sensitive information by sending a special type of\nattachment. (CVE-2020-12137)\n\nOriginal advisory details:\n\nAndre Protas, Richard Cloke, and Andy Nuttall discovered that Mailman\ndid not properly associate cross-site request forgery (CSRF) tokens\nto specific accounts. A remote attacker could use this to perform a\nCSRF attack to gain access to another account. (CVE-2021-42097)\n\nAndre Protas, Richard Cloke, and Andy Nuttall discovered that Mailman’s\ncross-site request forgery (CSRF) tokens for the options page are\nderived from the admin password. A remote attacker could possibly use\nthis to assist in performing a brute force attack against the admin\npassword. (CVE-2021-42096)\n","is_hidden":false,"release_packages":{"focal":[{"name":"mailman","version":"1:2.1.29-1ubuntu3.1","description":"Web-based mailing list manager","is_source":true},{"name":"mailman","version":"1:2.1.29-1ubuntu3.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/mailman","version_link":"https://launchpad.net/ubuntu/+source/mailman/1:2.1.29-1ubuntu3.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-12108","CVE-2020-12137","CVE-2021-42096","CVE-2020-15011","CVE-2021-42097"]}]}],"offset":45740,"limit":20,"total_results":79316}