NIXPKGS-2026-1794

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44604

7.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  21 packages

  • makerpm
  • rpm2targz
  • rpm-ostree
  • rpmextract
  • rpm-sequoia
  • perlPackages.RPM2
  • perl5Packages.RPM2
  • perl538Packages.RPM2
  • perl540Packages.RPM2
  • python312Packages.rpm
  • python313Packages.rpm
  • python314Packages.rpm
  • haskellPackages.rpm-nvr
  • haskellPackages.cabal-rpm
  • python312Packages.rpmfile
  • python313Packages.rpmfile
  • python314Packages.rpmfile
  • python312Packages.rpmfluff
  • haskellPackages.select-rpms
  • python314Packages.rpmfluff
  • python313Packages.rpmfluff
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command

• https://access.redhat.com/security/cve/CVE-2026-44604 x_refsource_REDHATvdb-entry
• RHBZ#2460967 x_refsource_REDHATissue-tracking

---

rpm

rhcos

rust-bootupd

satellite/iop-puptoo-rhel9

satellite/iop-yuptoo-rhel9

pen-drive/pen-drive-scanner-rhel9

satellite/iop-insights-engine-rhel9

NIXPKGS-2026-1793

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48155

4.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

pypdf: Possible large memory usage for large offsets for layout mode text

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8 x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3790 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.12.0 x_refsource_MISC

---

pypdf

• ==< 6.12.0

NIXPKGS-2026-1792

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-41184

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  10 packages

  • calico-app-policy
  • calicoctl
  • cni-plugins
  • dnsname-cni
  • calico-typha
  • confd-calico
  • calico-apiserver
  • calico-pod2daemon
  • cni-plugin-flannel
  • calico-kube-controllers
  3 months, 2 weeks ago
• @LeSuisse ignored reference https://w… 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

ServiceAccount token disclosure via install-cni container logs

• https://github.com/projectcalico/calico/pull/12502 patch
• https://github.com/projectcalico/calico/pull/12527 patch
• https://github.com/projectcalico/calico/pull/12526 patch

Ignored references (1)

• https://www.tigera.io/security-bulletins/tta-2026-001/ vendor-advisory

---

cni-plugin

• <3.31.6
• ==3.32.0

NIXPKGS-2026-1791

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48156

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

pypdf: Possible long runtimes for zero-only width values in cross-reference streams

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6 x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3791 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.12.0 x_refsource_MISC

---

pypdf

• ==< 6.12.0

NIXPKGS-2026-1790

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10028

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain

• https://access.redhat.com/security/cve/CVE-2026-10028 x_refsource_REDHATvdb-entry
• RHBZ#2465152 x_refsource_REDHATissue-tracking
• https://gitlab.gnome.org/GNOME/glib-networking/-/work_items/231

---

glib-networking

NIXPKGS-2026-1789

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48523

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f exploitx_refsource_CONFIRM

---

pyjwt

• ==>= 2.9.0, < 2.13.0

NIXPKGS-2026-1788

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-42250

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  18 packages

  • lbzip2
  • pbzip2
  • bzip2_1_1
  • indexed-bzip2
  • minimal-bootstrap.bzip2
  • haskellPackages.bzip2-clib
  • perlPackages.CompressBzip2
  • perl5Packages.CompressBzip2
  • perl538Packages.CompressBzip2
  • perl540Packages.CompressBzip2
  • perlPackages.CompressRawBzip2
  • minimal-bootstrap.bzip2-static
  • perl5Packages.CompressRawBzip2
  • python312Packages.indexed-bzip2
  • python313Packages.indexed-bzip2
  • python314Packages.indexed-bzip2
  • perl538Packages.CompressRawBzip2
  • perl540Packages.CompressRawBzip2
  3 months, 2 weeks ago
• @LeSuisse restored package bzip2_1_1 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Off-by-One Leading to Out-of-Bounds Write in bzip2

• https://cert.pl/en/posts/2026/05/CVE-2026-42250/ third-party-advisory
• https://sourceware.org/bzip2/ product
• https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/ vendor-advisory
• https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f3… patch

---

bzip2

• =<1.0.8
• ==35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

NIXPKGS-2026-1787

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10117

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • VDB-367295 | CTI Indicators (IOB, IOC, …
  • Submit #818586 | Open5GS NRF/UDM/UDR/NS…
  • https://github.com/open5gs/open5gs/
  3 months, 2 weeks ago
• @LeSuisse ignored package open5gs-webui 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service

• VDB-367295 | Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4474 issue-trackingexploit

Ignored references (3)

• VDB-367295 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• Submit #818586 | Open5GS NRF/UDM/UDR/NSSF/BSF/PCF/AMF/AUSF/SMF v2.7.7 Denial of Service third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.0
• ==2.7.6
• ==2.7.1
• ==2.7.5
• ==2.7.2
• ==2.7.4
• ==2.7.7
• ==2.7.3

NIXPKGS-2026-1786

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10156

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored package open5gs-webui 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • https://github.com/open5gs/open5gs/
  • Submit #818598 | Open5GS NRF v2.7.7 Den…
  • VDB-367409 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption

• VDB-367409 | Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4480 issue-trackingexploit

Ignored references (3)

• VDB-367409 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• Submit #818598 | Open5GS NRF v2.7.7 Denial of Service third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.0
• ==2.7.6
• ==2.7.1
• ==2.7.5
• ==2.7.2
• ==2.7.4
• ==2.7.7
• ==2.7.3

NIXPKGS-2026-1785

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10115

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • https://github.com/open5gs/open5gs/
  • Submit #818583 | Open5GS NRF、AMF、AUSF、B…
  • VDB-367293 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse ignored package open5gs-webui 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Open5GS Shared NF-profile nnrf-handler.c denial of service

• VDB-367293 | Open5GS Shared NF-profile nnrf-handler.c denial of service vdb-entry
• https://github.com/open5gs/open5gs/issues/4469 exploitissue-tracking
• https://github.com/open5gs/open5gs/issues/4469#issuecomment-4389805398 issue-tracking
• https://github.com/open5gs/open5gs/pull/4527 patchissue-tracking

Ignored references (3)

• VDB-367293 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• Submit #818583 | Open5GS NRF、AMF、AUSF、BSF、NSSF、PCF、SMF、UDM、UDR v2.7.7 Denial of Service third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.7
• ==2.7.3
• ==2.7.5
• ==2.7.1
• ==2.7.0
• ==2.7.4
• ==2.7.6
• ==2.7.2