mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
CVE IDs assigned for January Patch Wednesday
CVE IDs assigned for January 2021 Patch Wednesday.
This commit is contained in:
Chandan
parent
c265fe1e11
commit
ac318ea38e
@ -1,18 +1,224 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@paloaltonetworks.com",
|
||||
"DATE_PUBLIC": "2021-01-13T17:00:00.000Z",
|
||||
"ID": "CVE-2021-3031",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "PAN-OS: Information exposure in Ethernet data frame construction (Etherleak)"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PAN-OS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"platform": "PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200",
|
||||
"version_affected": "<",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.18"
|
||||
},
|
||||
{
|
||||
"platform": "PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200",
|
||||
"version_affected": "<",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.12"
|
||||
},
|
||||
{
|
||||
"platform": "PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200",
|
||||
"version_affected": "<",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.18"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.12"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "!",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.*"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Palo Alto Networks"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue was found by a customer of Palo Alto Networks during a security review."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect potentially sensitive information from these packets.\n\nThis issue is also known as Etherleak and is detected by security scanners as CVE-2003-0001.\nThis issue impacts:\nPAN-OS 8.1 version earlier than PAN-OS 8.1.18;\nPAN-OS 9.0 versions earlier than PAN-OS 9.0.12;\nPAN-OS 9.1 versions earlier than PAN-OS 9.1.5."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
|
||||
}
|
||||
],
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-200 Information Exposure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2021-3031"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue is fixed in PAN-OS 8.1.18, PAN-OS 9.0.12, PAN-OS 9.1.5, and all later PAN-OS versions."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"defect": [
|
||||
"PAN-124681"
|
||||
],
|
||||
"discovery": "USER"
|
||||
},
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"time": "2021-01-13T17:00:00.000Z",
|
||||
"value": "Initial publication"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "There is no workaround to prevent the information leak in the Ethernet packets; however, restricting access to the networks mitigates the risk of this issue."
|
||||
}
|
||||
],
|
||||
"x_advisoryEoL": false,
|
||||
"x_affectedList": [
|
||||
"PAN-OS 9.1.4",
|
||||
"PAN-OS 9.1.3-h1",
|
||||
"PAN-OS 9.1.3",
|
||||
"PAN-OS 9.1.2-h1",
|
||||
"PAN-OS 9.1.2",
|
||||
"PAN-OS 9.1.1",
|
||||
"PAN-OS 9.1.0-h3",
|
||||
"PAN-OS 9.1.0-h2",
|
||||
"PAN-OS 9.1.0-h1",
|
||||
"PAN-OS 9.1.0",
|
||||
"PAN-OS 9.1",
|
||||
"PAN-OS 9.0.11",
|
||||
"PAN-OS 9.0.10",
|
||||
"PAN-OS 9.0.9-h1",
|
||||
"PAN-OS 9.0.9",
|
||||
"PAN-OS 9.0.8",
|
||||
"PAN-OS 9.0.7",
|
||||
"PAN-OS 9.0.6",
|
||||
"PAN-OS 9.0.5",
|
||||
"PAN-OS 9.0.4",
|
||||
"PAN-OS 9.0.3-h3",
|
||||
"PAN-OS 9.0.3-h2",
|
||||
"PAN-OS 9.0.3-h1",
|
||||
"PAN-OS 9.0.3",
|
||||
"PAN-OS 9.0.2-h4",
|
||||
"PAN-OS 9.0.2-h3",
|
||||
"PAN-OS 9.0.2-h2",
|
||||
"PAN-OS 9.0.2-h1",
|
||||
"PAN-OS 9.0.2",
|
||||
"PAN-OS 9.0.1",
|
||||
"PAN-OS 9.0.0",
|
||||
"PAN-OS 9.0",
|
||||
"PAN-OS 8.1.17",
|
||||
"PAN-OS 8.1.16",
|
||||
"PAN-OS 8.1.15-h3",
|
||||
"PAN-OS 8.1.15-h2",
|
||||
"PAN-OS 8.1.15-h1",
|
||||
"PAN-OS 8.1.15",
|
||||
"PAN-OS 8.1.14-h2",
|
||||
"PAN-OS 8.1.14-h1",
|
||||
"PAN-OS 8.1.14",
|
||||
"PAN-OS 8.1.13",
|
||||
"PAN-OS 8.1.12",
|
||||
"PAN-OS 8.1.11",
|
||||
"PAN-OS 8.1.10",
|
||||
"PAN-OS 8.1.9-h4",
|
||||
"PAN-OS 8.1.9-h3",
|
||||
"PAN-OS 8.1.9-h2",
|
||||
"PAN-OS 8.1.9-h1",
|
||||
"PAN-OS 8.1.9",
|
||||
"PAN-OS 8.1.8-h5",
|
||||
"PAN-OS 8.1.8-h4",
|
||||
"PAN-OS 8.1.8-h3",
|
||||
"PAN-OS 8.1.8-h2",
|
||||
"PAN-OS 8.1.8-h1",
|
||||
"PAN-OS 8.1.8",
|
||||
"PAN-OS 8.1.7",
|
||||
"PAN-OS 8.1.6-h2",
|
||||
"PAN-OS 8.1.6-h1",
|
||||
"PAN-OS 8.1.6",
|
||||
"PAN-OS 8.1.5",
|
||||
"PAN-OS 8.1.4",
|
||||
"PAN-OS 8.1.3",
|
||||
"PAN-OS 8.1.2",
|
||||
"PAN-OS 8.1.1",
|
||||
"PAN-OS 8.1.0",
|
||||
"PAN-OS 8.1"
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,233 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@paloaltonetworks.com",
|
||||
"DATE_PUBLIC": "2021-01-13T17:00:00.000Z",
|
||||
"ID": "CVE-2021-3032",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "PAN-OS: Configuration secrets for log forwarding may be logged in system logs"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PAN-OS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.18"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.12"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.18"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.12"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Palo Alto Networks"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"configuration": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue is only applicable to PAN-OS devices configured to use log forwarding. You can verify this in the management web interface: Device -> Log Settings."
|
||||
}
|
||||
],
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue was found by My Tran, Mai Phan, and Claire Zhou of Palo Alto Networks during internal security testing."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log.\n\nLogged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in any certificate profiles set for log forwarding server profiles.\n\nThis issue impacts:\nPAN-OS 8.1 versions earlier than PAN-OS 8.1.18;\nPAN-OS 9.0 versions earlier than PAN-OS 9.0.12;\nPAN-OS 9.1 versions earlier than PAN-OS 9.1.4;\nPAN-OS 10.0 versions earlier than PAN-OS 10.0.1."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
|
||||
}
|
||||
],
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.4,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-532 Information Exposure Through Log Files"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2021-3032"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "If the PAN-OS firewall is impacted, then you must clear the configuration file (/var/log/pan/logrcvr.log). This can be accomplished by running the following CLI command:\n \"delete debug-log mp-log file logrcvr.log\".\n\nThis issue is fixed in PAN-OS 8.1.18, PAN-OS 9.0.12, PAN-OS 9.1.4, PAN-OS 10.0.1, and all later PAN-OS versions."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"defect": [
|
||||
"PAN-149377"
|
||||
],
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"time": "2021-01-13T17:00:00.000Z",
|
||||
"value": "Initial publication"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue requires access to PAN-OS log files generated in the system. You can mitigate the impact of this issue by following best practices for securing the PAN-OS management interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation, available at https://docs.paloaltonetworks.com/best-practices."
|
||||
}
|
||||
],
|
||||
"x_advisoryEoL": false,
|
||||
"x_affectedList": [
|
||||
"PAN-OS 10.0.0",
|
||||
"PAN-OS 10.0",
|
||||
"PAN-OS 9.1.3-h1",
|
||||
"PAN-OS 9.1.3",
|
||||
"PAN-OS 9.1.2-h1",
|
||||
"PAN-OS 9.1.2",
|
||||
"PAN-OS 9.1.1",
|
||||
"PAN-OS 9.1.0-h3",
|
||||
"PAN-OS 9.1.0-h2",
|
||||
"PAN-OS 9.1.0-h1",
|
||||
"PAN-OS 9.1.0",
|
||||
"PAN-OS 9.1",
|
||||
"PAN-OS 9.0.11",
|
||||
"PAN-OS 9.0.10",
|
||||
"PAN-OS 9.0.9-h1",
|
||||
"PAN-OS 9.0.9",
|
||||
"PAN-OS 9.0.8",
|
||||
"PAN-OS 9.0.7",
|
||||
"PAN-OS 9.0.6",
|
||||
"PAN-OS 9.0.5",
|
||||
"PAN-OS 9.0.4",
|
||||
"PAN-OS 9.0.3-h3",
|
||||
"PAN-OS 9.0.3-h2",
|
||||
"PAN-OS 9.0.3-h1",
|
||||
"PAN-OS 9.0.3",
|
||||
"PAN-OS 9.0.2-h4",
|
||||
"PAN-OS 9.0.2-h3",
|
||||
"PAN-OS 9.0.2-h2",
|
||||
"PAN-OS 9.0.2-h1",
|
||||
"PAN-OS 9.0.2",
|
||||
"PAN-OS 9.0.1",
|
||||
"PAN-OS 9.0.0",
|
||||
"PAN-OS 9.0",
|
||||
"PAN-OS 8.1.17",
|
||||
"PAN-OS 8.1.16",
|
||||
"PAN-OS 8.1.15-h3",
|
||||
"PAN-OS 8.1.15-h2",
|
||||
"PAN-OS 8.1.15-h1",
|
||||
"PAN-OS 8.1.15",
|
||||
"PAN-OS 8.1.14-h2",
|
||||
"PAN-OS 8.1.14-h1",
|
||||
"PAN-OS 8.1.14",
|
||||
"PAN-OS 8.1.13",
|
||||
"PAN-OS 8.1.12",
|
||||
"PAN-OS 8.1.11",
|
||||
"PAN-OS 8.1.10",
|
||||
"PAN-OS 8.1.9-h4",
|
||||
"PAN-OS 8.1.9-h3",
|
||||
"PAN-OS 8.1.9-h2",
|
||||
"PAN-OS 8.1.9-h1",
|
||||
"PAN-OS 8.1.9",
|
||||
"PAN-OS 8.1.8-h5",
|
||||
"PAN-OS 8.1.8-h4",
|
||||
"PAN-OS 8.1.8-h3",
|
||||
"PAN-OS 8.1.8-h2",
|
||||
"PAN-OS 8.1.8-h1",
|
||||
"PAN-OS 8.1.8",
|
||||
"PAN-OS 8.1.7",
|
||||
"PAN-OS 8.1.6-h2",
|
||||
"PAN-OS 8.1.6-h1",
|
||||
"PAN-OS 8.1.6",
|
||||
"PAN-OS 8.1.5",
|
||||
"PAN-OS 8.1.4",
|
||||
"PAN-OS 8.1.3",
|
||||
"PAN-OS 8.1.2",
|
||||
"PAN-OS 8.1.1",
|
||||
"PAN-OS 8.1.0",
|
||||
"PAN-OS 8.1"
|
||||
]
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user