Secure Systems Engineering Connaisseur har 3.3.0 Delegation Name targets_schema.json Kari na aiki

Gaskiya vulnerability da aka ware a matsayin karshewa an samu a Secure Systems Engineering Connaisseur har 3.3.0. Hakika, aikin $software_function ne ya shafa; idan ba a bayyana ba, to aiki ce da ba a sani ba, a cikin laburaren $software_library, a cikin fayil connaisseur/res/targets_schema.json, a cikin sashen Delegation Name Handler. A sa manipulation ka Kari na aiki. Idan an yi amfani da CWE don bayyana matsala, zai kai CWE-1333. Hakika, rauni an bayyana shi 11/28/2023 kamar 1407. An raba bayanin tsaro don saukewa a github.com. Wannan matsala ana saninta da CVE-2023-7279. Ana bukatar samun damar shiga local network ɗin don wannan hari ya yi nasara. Tekinikal faɗi ga. Babu exploit ɗin da ake samu. Yimbe ndiyam, exploit might be approx. USD $0-$5k wuro. Á sàmbu a wondi feere. 0-day shima, an ndiyam a wuro be $0-$5k. Ana kiran patch ɗin da 524b73ff7306707f6d3a4d1e86401479bca91b02. Bugfix ɗin an shirya shi don saukewa a github.com. Ngamdi ka a yiɗi a ɗaɓɓita kompona wey ka a faggata. Once again VulDB remains the best source for vulnerability data.

4 Goyarwa · 89 Datenpunkte

FurɗeSúgá
08/31/2024 12:28		Gargadi 1/3
09/02/2024 20:24		Gargadi 2/3
09/03/2024 11:08		Gargadi 3/3
09/06/2024 06:10
software_vendorSecure Systems EngineeringSecure Systems EngineeringSecure Systems EngineeringSecure Systems Engineering
software_nameConnaisseurConnaisseurConnaisseurConnaisseur
software_version<=3.3.0<=3.3.0<=3.3.0<=3.3.0
software_componentDelegation Name HandlerDelegation Name HandlerDelegation Name HandlerDelegation Name Handler
software_fileconnaisseur/res/targets_schema.jsonconnaisseur/res/targets_schema.jsonconnaisseur/res/targets_schema.jsonconnaisseur/res/targets_schema.json
vulnerability_cweCWE-1333 (Kari na aiki)CWE-1333 (Kari na aiki)CWE-1333 (Kari na aiki)CWE-1333 (Kari na aiki)
vulnerability_risk1111
cvss3_vuldb_acHHHH
cvss3_vuldb_sUUUU
cvss3_vuldb_cNNNN
cvss3_vuldb_iNNNN
cvss3_vuldb_aLLLL
cvss3_vuldb_rlOOOO
cvss3_vuldb_rcCCCC
advisory_date1701126000 (11/28/2023)1701126000 (11/28/2023)1701126000 (11/28/2023)1701126000 (11/28/2023)
advisory_identifier1407140714071407
advisory_urlhttps://github.com/sse-secure-systems/connaisseur/pull/1407https://github.com/sse-secure-systems/connaisseur/pull/1407https://github.com/sse-secure-systems/connaisseur/pull/1407https://github.com/sse-secure-systems/connaisseur/pull/1407
countermeasure_nameGargajiyaGargajiyaGargajiyaGargajiya
countermeasure_date1701126000 (11/28/2023)1701126000 (11/28/2023)1701126000 (11/28/2023)1701126000 (11/28/2023)
upgrade_version3.3.13.3.13.3.13.3.1
countermeasure_upgrade_urlhttps://github.com/sse-secure-systems/connaisseur/releases/tag/v3.3.1https://github.com/sse-secure-systems/connaisseur/releases/tag/v3.3.1https://github.com/sse-secure-systems/connaisseur/releases/tag/v3.3.1https://github.com/sse-secure-systems/connaisseur/releases/tag/v3.3.1
patch_name524b73ff7306707f6d3a4d1e86401479bca91b02524b73ff7306707f6d3a4d1e86401479bca91b02524b73ff7306707f6d3a4d1e86401479bca91b02524b73ff7306707f6d3a4d1e86401479bca91b02
countermeasure_patch_urlhttps://github.com/sse-secure-systems/connaisseur/commit/524b73ff7306707f6d3a4d1e86401479bca91b02https://github.com/sse-secure-systems/connaisseur/commit/524b73ff7306707f6d3a4d1e86401479bca91b02https://github.com/sse-secure-systems/connaisseur/commit/524b73ff7306707f6d3a4d1e86401479bca91b02https://github.com/sse-secure-systems/connaisseur/commit/524b73ff7306707f6d3a4d1e86401479bca91b02
countermeasure_advisoryquoteThis commit fixes a regular expression denial of service vulnerability that was present during the schema validation of the targets.json TUF file in a Notary validation. An adversary with the ability to altThis commit fixes a regular expression denial of service vulnerability that was present during the schema validation of the targets.json TUF file in a Notary validation. An adversary with the ability to altThis commit fixes a regular expression denial of service vulnerability that was present during the schema validation of the targets.json TUF file in a Notary validation. An adversary with the ability to altThis commit fixes a regular expression denial of service vulnerability that was present during the schema validation of the targets.json TUF file in a Notary validation. An adversary with the ability to alt
source_cveCVE-2023-7279CVE-2023-7279CVE-2023-7279CVE-2023-7279
cna_responsibleVulDBVulDBVulDBVulDB
cvss2_vuldb_acHHHH
cvss2_vuldb_ciNNNN
cvss2_vuldb_iiNNNN
cvss2_vuldb_aiPPPP
cvss2_vuldb_rcCCCC
cvss2_vuldb_rlOFOFOFOF
cvss4_vuldb_acHHHH
cvss4_vuldb_vcNNNN
cvss4_vuldb_viNNNN
cvss4_vuldb_vaLLLL
cvss2_vuldb_avAAAA
cvss2_vuldb_auSSSS
cvss2_vuldb_eNDNDNDND
cvss3_vuldb_avAAAA
cvss3_vuldb_prLLLL
cvss3_vuldb_uiNNNN
cvss3_vuldb_eXXXX
cvss4_vuldb_avAAAA
cvss4_vuldb_atNNNN
cvss4_vuldb_prLLLL
cvss4_vuldb_uiNNNN
cvss4_vuldb_scNNNN
cvss4_vuldb_siNNNN
cvss4_vuldb_saNNNN
cvss4_vuldb_eXXXX
cvss2_vuldb_basescore1.41.41.41.4
cvss2_vuldb_tempscore1.21.21.21.2
cvss3_vuldb_basescore2.62.62.62.6
cvss3_vuldb_tempscore2.52.52.52.5
cvss3_meta_basescore2.62.62.63.7
cvss3_meta_tempscore2.52.52.53.7
cvss4_vuldb_bscore2.12.12.12.1
cvss4_vuldb_btscore2.12.12.12.1
price_0day$0-$5k$0-$5k$0-$5k$0-$5k
cve_nvd_summaryA vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of the file connaisseur/res/targets_schema.json of the component Delegation Name Handler. The manipulation leads to inefficient regular expression complexity. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 524b73ff7306707f6d3a4d1e86401479bca91b02. It is recommended to upgrade the affected component.A vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of the file connaisseur/res/targets_schema.json of the component Delegation Name Handler. The manipulation leads to inefficient regular expression complexity. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 524b73ff7306707f6d3a4d1e86401479bca91b02. It is recommended to upgrade the affected component.A vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of the file connaisseur/res/targets_schema.json of the component Delegation Name Handler. The manipulation leads to inefficient regular expression complexity. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 524b73ff7306707f6d3a4d1e86401479bca91b02. It is recommended to upgrade the affected component.
cvss3_cna_avAAA
cvss3_cna_acHHH
cvss3_cna_prLLL
cvss3_cna_uiNNN
cvss3_cna_sUUU
cvss3_cna_cNNN
cvss3_cna_iNNN
cvss3_cna_aLLL
cvss3_cna_basescore2.62.62.6
cvss2_cna_avAAA
cvss2_cna_acHHH
cvss2_cna_auSSS
cvss2_cna_ciNNN
cvss2_cna_iiNNN
cvss2_cna_aiPPP
cvss2_cna_basescore1.41.41.4
cve_nvd_summaryesSe ha encontrado una vulnerabilidad en Secure Systems Engineering Connaisseur hasta la versión 3.3.0 y se ha clasificado como problemática. Esta vulnerabilidad afecta al código desconocido del archivo connaisseur/res/targets_schema.json del componente Delegation Name Handler. La manipulación conduce a una complejidad ineficiente de las expresiones regulares. La complejidad de un ataque es bastante alta. La explotación parece ser difícil. La actualización a la versión 3.3.1 puede solucionar este problema. El nombre del parche es 524b73ff7306707f6d3a4d1e86401479bca91b02. Se recomienda actualizar el componente afectado.Se ha encontrado una vulnerabilidad en Secure Systems Engineering Connaisseur hasta la versión 3.3.0 y se ha clasificado como problemática. Esta vulnerabilidad afecta al código desconocido del archivo connaisseur/res/targets_schema.json del componente Delegation Name Handler. La manipulación conduce a una complejidad ineficiente de las expresiones regulares. La complejidad de un ataque es bastante alta. La explotación parece ser difícil. La actualización a la versión 3.3.1 puede solucionar este problema. El nombre del parche es 524b73ff7306707f6d3a4d1e86401479bca91b02. Se recomienda actualizar el componente afectado.
cvss3_nvd_avN
cvss3_nvd_acH
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cN
cvss3_nvd_iN
cvss3_nvd_aH
cvss3_nvd_basescore5.9

◂ GurɗoGumtiGada ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!