mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
132 lines
5.5 KiB
JSON
132 lines
5.5 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2023-42419",
|
|
"ASSIGNER": "info@cybellum.com",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "Maintenance Server, in\u00a0Cybellum's\u00a0QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key.\n\n\nAn attacker with administrative privileges & access to the air-gapped server could potentially\u00a0use this key to run commands on the server.\nThe issue was resolved in version 2.28.\nEarlier versions, including all Cybellum 1.x versions, and distributions for the rest of the world remain unaffected.\n\n"
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "cwe-321 Use of Hard-coded Cryptographic Key"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "Cybellum",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "Maintenance Server",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"lessThanOrEqual": "2.27",
|
|
"status": "affected",
|
|
"version": "2.15.5",
|
|
"versionType": "custom"
|
|
},
|
|
{
|
|
"status": "unaffected",
|
|
"version": "1.*"
|
|
},
|
|
{
|
|
"lessThanOrEqual": "2.19",
|
|
"status": "unaffected",
|
|
"version": "2.0",
|
|
"versionType": "custom"
|
|
},
|
|
{
|
|
"lessThanOrEqual": "or above",
|
|
"status": "unaffected",
|
|
"version": "2.28",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unaffected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://cybellum.com/",
|
|
"refsource": "MISC",
|
|
"name": "https://cybellum.com/"
|
|
}
|
|
]
|
|
},
|
|
"generator": {
|
|
"engine": "Vulnogram 0.1.0-dev"
|
|
},
|
|
"source": {
|
|
"discovery": "EXTERNAL"
|
|
},
|
|
"solution": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "\n\n\n\n\n\n<span style=\"background-color: rgb(255, 255, 255);\">Cybellum's </span>QCOW air-gapped distribution (China Edition), versions \n\n2.15.5\n\n through 2.27 -> Upgrade to version 2.28 or above<br>All other versions/distributions -> Unaffected"
|
|
}
|
|
],
|
|
"value": "\n\n\n\n\nCybellum's QCOW air-gapped distribution (China Edition), versions \n\n2.15.5\n\n through 2.27 -> Upgrade to version 2.28 or above\nAll other versions/distributions -> Unaffected"
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Delikely"
|
|
}
|
|
],
|
|
"impact": {
|
|
"cvss": [
|
|
{
|
|
"attackComplexity": "HIGH",
|
|
"attackVector": "LOCAL",
|
|
"availabilityImpact": "LOW",
|
|
"baseScore": 3.8,
|
|
"baseSeverity": "LOW",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "LOW",
|
|
"privilegesRequired": "HIGH",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "REQUIRED",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L",
|
|
"version": "3.1"
|
|
}
|
|
]
|
|
}
|
|
} |