Vulnerability Name: CVE-2022-0778 (CCN-221911) Assigned: 2022-03-15 Published: 2022-03-15 Updated: 2022-11-09 Summary: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). CVSS v3 Severity: 7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 6.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 6.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): High
7.5 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 6.7 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): High
CVSS v2 Severity: 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): LowAuthentication (Au): NoneImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): NoneIntegrity (I): NoneAvailibility (A): Complete
Vulnerability Type: CWE-835 Vulnerability Consequences: Denial of Service References: Source: MITRECVE-2022-0778 http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4 (CVE-2022-0778) - CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf openssl-cve20220778-dos(221911) https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=3118eb64934499d93db3230748a452351d1d9a65 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=380085481c64de749a6dd25cdf0bcf4360b30f83 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a466912611aa6cbdf550cd10601390e587451246 [debian-lts-announce] 20220317 [SECURITY] [DLA 2952-1] openssl security update [debian-lts-announce] 20220317 [SECURITY] [DLA 2953-1] openssl1.0 security update FEDORA-2022-9e88b5d8d7 FEDORA-2022-a5f51502f0 FEDORA-2022-8bb51f6901 OpenSSL security releases require Node.js security releases OpenSSL 1.0.2 / 1.1.1 / 3.0 BN_mod_sqrt() Infinite Loop https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002 GLSA-202210-02 https://security.netapp.com/advisory/ntap-20220321-0002/ https://security.netapp.com/advisory/ntap-20220429-0005/ About the security content of Security Update 2022-004 Catalina About the security content of macOS Big Sur 11.6.6 About the security content of macOS Monterey 12.4 https://support.apple.com/kb/HT213255 https://support.apple.com/kb/HT213256 https://support.apple.com/kb/HT213257 Siemens OpenSSL Affected Industrial Products (Update D) Hitachi Energy MicroSCADA Pro X SYS600 DSA-5103 Multiple Vulnerabilities in node.js OpenSSL for IBM i is vulnerable to a denial of service due to a flaw in the BN_mod_sqrt() function (CVE-2022-0778) Vulnerability in OpenSSL affect App Connect Professional. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to CVE-2022-0778 Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and IBM Business Process Manager (BPM) IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in OpenSSL WebSphere MQ for HP NonStop Server is affected by OpenSSL vulnerability CVE-2022-0778 AIX is vulnerable to a denial of service due to OpenSSL (CVE-2022-0778) A vulnerability in OpenSSL affects IBM InfoSphere Information Server (CVE-2022-0778) IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from expat, Golang Go, gcc, openssl and libxml. OpenSSL publicly disclosed vulnerability affects IBM MobileFirst Platform Foundation IBM Sterling Connect:Express for UNIX is vulnerable to denial of service due to OpenSSL (CVE-2022-0778) IBM MQ for HPE NonStop Server is affected by OpenSSL vulnerability CVE-2022-0778 Vulnerability in OpenSSL (CVE-2022-0778) affects Power HMC Vulnerability in OpenSSL affects IBM Watson Explorer (CVE-2022-0778) Public disclosed vulnerability from OpenSSL affects IBM Netezza Host Management Multiple vulnerabilities in multiple dependencies affect IBM MessageGateway/ MessageSight IBM MaaS360 Cloud Extender Agent, Mobile Enterprise Gateway and VPN module have multiple vulnerabilities (CVE-2021-22060, CVE-2022-22950, CVE-2022-0547, CVE-2022-0778, CVE-2022-22965) Vulnerabilities have been identified in Spring Framework, OpenSSL and Apache HTTP Server shipped with the DS8000 Hardware Management Console (HMC) Vulnerabilities in Golang Go, OpenSSL, Python, and XStream affect IBM Spectrum Copy Data Management IBM App Connect Enterprise & IBM Integration Bus are vulnerable to a denial of service, due to OpenSSL (CVE-2022-0778) A security vulnerability has been fixed in IBM Security Identity Manager Virtual Appliance(CVE-2020-0778) IBM QRadar WinCollect is vulnerable to using components with known vulnerabilities Denial of Service vulnerability in OpenSSL may affect IBM Spectrum Protect Backup-Archive Client (CVE-2022-0778) Vulnerabilities in Samba, OpenSSL, Python, and XStream affect IBM Spectrum Protect Plus (CVE-2021-20254, CVE-2021-3712, CVE-2021-43859, CVE-2022-0778, CVE-2020-25717, CVE-2021-23192, CVE-2021-3733) IBM Security Guardium is affected by multiple vulnerabilities IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities IBM QRadar Network Packet Capture includes multiple vulnerable components. IBM QRadar Network Security is affected by Vulnerability in OpenSSL (CVE-2022-0778) Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors IBM MQ Appliance affected by an OpenSSL vulnerability (CVE-2022-0778) Vulnerabilities in OpenSSL affect IBM Rational ClearQuest (CVE-2022-0778, CVE-2022-1292) Vulnerability in OpenSSL affects IBM Event Streams (CVE-2022-0778) There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises (CVE-2022-0778, CVE-2021-38868, CVE-2021-29799, CVE-2021-29790, CVE-2021-29788) Vulnerability in OpenSSL (CVE-2022-0778) affects PowerVM Vulnerability in OpenSSL affects IBM Rational ClearCase (CVE-2022-1292, CVE-2022-0778) IBM Cloud Pak for Security is vulnerable to Using Components with Known Vulnerabilities OpenSSL as used by IBM QRadar SIEM is vulnerable to denial of service (CVE-2022-0778) Denial of service vulnerability in OpenSSL as shipped with IBM Security Verify Bridge Docker image (CVE-2022-0778) IBM Sterling Connect:Direct for UNIX Certified Container is affected by denial of service vulnerability in version 1.1.1k-5 Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to OpenSSL CVE-2022-0778 IBM Workload Scheduler is potentially vulnerable to denial of service due to CVE-2022-0778 affecting OpenSSL component Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2022 Multiple vulnerabilities in expat, glibc, http server, dojo, openssl shipped with IBM Cloud Pak System This Power System update is being released to address CVE 2022-0778 Due to use of OpenSSL, IBM Virtualization Engine TS7700 is vulnerable to denial of service (CVE-2022-0778) and privilege escalation (CVE-2022-1292) Vulnerability in Fabric OS firmware used by IBM b-type SAN directors and switches. Vulnerability in OpenSSL affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products Multiple Vulnerabilities in Cloud Pak for Watson AIOPs Vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus SQL, File Indexing, and Windows Host agents Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in OpenSSL (CVE-2022-0778) IBM Sterling Connect:Direct for HP NonStop vulnerable to denial of service due to OpenSSL (CVE-2022-0778) Vulnerability in OpenSSL affects IBM FlashSystem models V840 and V900 This Power System update is being released to address multiple CVEs for vTPM1.2 Security vulnerabilities have been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component IBM Security Verify Governance is vulnerable to denial of service due to an OpenSSL vulnerability IBM Security Verify Governance is vulnerable to denial of service due to OpenSSL as a part of Node.js IBM Cloud Pak for Security includes components with multiple known vulnerabilities Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities. IBM Safer Payments is vulnerable to OpenSSL Denial of Sevice Attack (CVE-2022-0778) OpenSSL Security Advisory [15 March 2022] https://www.openssl.org/news/secadv/20220315.txt Oracle Critical Patch Update Advisory - April 2022 https://www.oracle.com/security-alerts/cpuapr2022.html Oracle Critical Patch Update Advisory - July 2022 N/A https://www.tenable.com/security/tns-2022-06 https://www.tenable.com/security/tns-2022-07 https://www.tenable.com/security/tns-2022-08 https://www.tenable.com/security/tns-2022-09 Vulnerable Configuration: Configuration 1 :cpe:/a:openssl:openssl:*:*:*:*:*:*:*:* (Version >= 3.0.0 and < 3.0.2)OR cpe:/a:openssl:openssl:*:*:*:*:*:*:*:* (Version >= 1.0.2 and < 1.0.2zd) OR cpe:/a:openssl:openssl:*:*:*:*:*:*:*:* (Version >= 1.1.0 and < 1.1.1n) Configuration 2 :cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:* OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:* OR cpe:/o:debian:debian_linux:11.0:*:*:*:*:*:*:* Configuration 3 :cpe:/a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* OR cpe:/a:netapp:storagegrid:-:*:*:*:*:*:*:* OR cpe:/a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* OR cpe:/a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* OR cpe:/a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:* Configuration 4 :cpe:/o:netapp:a250_firmware:-:*:*:*:*:*:*:* AND cpe:/h:netapp:a250:-:*:*:*:*:*:*:* Configuration 5 :cpe:/o:netapp:500f_firmware:-:*:*:*:*:*:*:* AND cpe:/h:netapp:500f:-:*:*:*:*:*:*:* Configuration 6 :cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:* OR cpe:/o:fedoraproject:fedora:36:*:*:*:*:*:*:* Configuration 7 :cpe:/a:tenable:nessus:*:*:*:*:*:*:*:* (Version >= 10.0.0 and < 10.1.2)OR cpe:/a:tenable:nessus:*:*:*:*:*:*:*:* (Version < 8.15.4) Configuration 8 :cpe:/a:mariadb:mariadb:*:*:*:*:*:*:*:* (Version >= 10.3.0 and < 10.3.33)OR cpe:/a:mariadb:mariadb:*:*:*:*:*:*:*:* (Version >= 10.4.0 and < 10.4.23) OR cpe:/a:mariadb:mariadb:*:*:*:*:*:*:*:* (Version >= 10.5.0 and < 10.5.14) OR cpe:/a:mariadb:mariadb:*:*:*:*:*:*:*:* (Version >= 10.7.0 and < 10.7.2) OR cpe:/a:mariadb:mariadb:*:*:*:*:*:*:*:* (Version >= 10.6.0 and < 10.6.6) OR cpe:/a:mariadb:mariadb:*:*:*:*:*:*:*:* (Version >= 10.2.0 and < 10.2.42) Configuration 9 :cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:* (Version >= 12.0.0 and <= 12.12.0)OR cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:* (Version > 17.0.0 and < 17.7.2) OR cpe:/a:nodejs:node.js:*:*:*:*:lts:*:*:* (Version >= 16.13.0 and < 16.14.2) OR cpe:/a:nodejs:node.js:*:*:*:*:lts:*:*:* (Version >= 14.15.0 and < 14.19.1) OR cpe:/a:nodejs:node.js:*:*:*:*:lts:*:*:* (Version >= 12.13.0 and < 12.22.11) OR cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:* (Version > 16.0.0 and <= 16.12.0) OR cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:* (Version > 14.0.0 and <= 14.14.0) Configuration RedHat 1 :cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:* Configuration RedHat 2 :cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:* Configuration RedHat 3 :cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:* Configuration RedHat 4 :cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:* Configuration RedHat 5 :cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:* Configuration RedHat 6 :cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:* Configuration RedHat 7 :cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:* Configuration RedHat 8 :cpe:/o:redhat:rhel_els:6:*:*:*:*:*:*:* Configuration RedHat 9 :cpe:/a:redhat:enterprise_linux:9:*:*:*:*:*:*:* Configuration RedHat 10 :cpe:/a:redhat:enterprise_linux:9::appstream:*:*:*:*:* Configuration RedHat 11 :cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:* Configuration RedHat 12 :cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:* Configuration CCN 1 :cpe:/a:openssl:openssl:1.1.1:*:*:*:*:*:*:* OR cpe:/a:nodejs:node.js:12:*:*:*:*:*:*:* OR cpe:/a:nodejs:node.js:14.0:*:*:*:*:*:*:* OR cpe:/a:openssl:openssl:1.0.2:*:*:*:*:*:*:* OR cpe:/a:openssl:openssl:3.0.0:*:*:*:*:*:*:* AND cpe:/o:ibm:aix:7.1:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_clearcase:8.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_clearcase:8.0.0:*:*:*:*:*:*:* OR cpe:/o:ibm:i:7.2:*:*:*:*:*:*:* OR cpe:/a:ibm:websphere_mq:5.3.1:*:*:*:*:*:*:* OR cpe:/a:ibm:watson_explorer:11.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:netcool/system_service_monitor:4.0.1:*:*:*:*:*:*:* OR cpe:/o:ibm:i:7.3:*:*:*:*:*:*:* OR cpe:/a:ibm:watson_explorer:11.0.1:*:*:*:*:*:*:* OR cpe:/o:ibm:aix:7.2:*:*:*:*:*:*:* OR cpe:/a:ibm:watson_explorer:11.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_clearquest:9.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:workload_scheduler:9.4:*:*:*:*:*:*:* OR cpe:/a:ibm:business_process_manager:8.6.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_clearcase:9.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:* OR cpe:/a:ibm:spectrum_protect_plus:10.1.0:*:*:*:*:*:*:* OR cpe:/a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:* OR cpe:/a:ibm:qradar_network_security:5.4.0:*:*:*:*:*:*:* OR cpe:/a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:watson_explorer:12.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:sterling_connect:express:1.5.0:*:*:*:unix:*:*:* OR cpe:/a:ibm:app_connect:11.0.0.0:*:*:*:enterprise:*:*:* OR cpe:/a:ibm:integration_bus:10.0.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:qradar_network_security:5.5.0:*:*:*:*:*:*:* OR cpe:/a:ibm:sterling_connect:direct:6.0.0:*:*:*:unix:*:*:* OR cpe:/a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:watson_explorer:12.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:watson_explorer:12.0.2:*:*:*:*:*:*:* OR cpe:/o:ibm:i:7.4:*:*:*:*:*:*:* OR cpe:/a:ibm:qradar_network_packet_capture:7.3:*:*:*:*:*:*:* OR cpe:/a:ibm:vios:3.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_transformation_advisor:2.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:iot_messagesight:5.0.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:19.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:business_process_manager:8.5.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:mq_for_hpe_nonstop:8.1.0:*:*:*:*:*:*:* OR cpe:/a:ibm:watson_explorer:12.0.3:*:deep_analytics:*:analytical_components:*:*:* OR cpe:/a:ibm:security_guardium:11.0:*:*:*:*:*:*:* OR cpe:/a:ibm:security_guardium:11.1:*:*:*:*:*:*:* OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:20.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_clearquest:9.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_clearquest:9.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:event_streams:10.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:20.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:security_guardium:11.2:*:*:*:*:*:*:* OR cpe:/a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:event_streams:10.1.0:*:*:*:*:*:*:* OR cpe:/a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:20.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:voice_gateway:1.0.7:*:*:*:*:*:*:* OR cpe:/a:ibm:workload_scheduler:9.5:*:*:*:*:*:*:* OR cpe:/a:ibm:security_guardium:11.3:*:*:*:*:*:*:* OR cpe:/a:ibm:event_streams:10.2.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:21.0.2:-:*:*:*:*:*:* OR cpe:/a:ibm:event_streams:10.3.0:*:*:*:*:*:*:* OR cpe:/a:ibm:event_streams:10.3.1:*:*:*:*:*:*:* OR cpe:/a:ibm:hardware_management_console:9.2.950.0:*:*:*:*:*:*:* OR cpe:/a:ibm:security_guardium:11.4:*:*:*:*:*:*:* OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.1.0:*:*:*:*:*:*:* OR cpe:/o:ibm:aix:7.3:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:19.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:business_automation_workflow:21.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:* OR cpe:/a:ibm:robotic_process_automation:21.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_automation:19.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:spectrum_copy_data_management:2.2.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:business_automation_workflow:21.0.1:*:*:*:traditional:*:*:* OR cpe:/a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:robotic_process_automation:21.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:app_connect_enterprise:12.0.4.0:*:*:*:*:*:*:* OR cpe:/a:ibm:spectrum_virtualize:8.2:*:*:*:*:*:*:* OR cpe:/a:ibm:spectrum_copy_data_management:2.2.15.0:*:*:*:*:*:*:* OR cpe:/a:ibm:spectrum_protect_client:8.1.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:security_verify_governance:10.0:*:*:*:*:*:*:* OR cpe:/a:ibm:spectrum_virtualize:7.8:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_for_security:1.10.6.0:*:*:*:*:*:*:* OR cpe:/a:ibm:safer_payments:6.1.0.00:*:*:*:*:*:*:* OR cpe:/a:ibm:safer_payments:6.2.0.00:*:*:*:*:*:*:* OR cpe:/a:ibm:safer_payments:6.3.0.00:*:*:*:*:*:*:* OR cpe:/a:ibm:safer_payments:6.4.0.00:*:*:*:*:*:*:* Oval Definitions BACK
openssl openssl *
openssl openssl *
openssl openssl *
debian debian linux 9.0
debian debian linux 10.0
debian debian linux 11.0
netapp santricity smi-s provider -
netapp storagegrid -
netapp clustered data ontap -
netapp clustered data ontap antivirus connector -
netapp cloud volumes ontap mediator -
netapp a250 firmware -
netapp a250 -
netapp 500f firmware -
netapp 500f -
fedoraproject fedora 34
fedoraproject fedora 36
tenable nessus *
tenable nessus *
mariadb mariadb *
mariadb mariadb *
mariadb mariadb *
mariadb mariadb *
mariadb mariadb *
mariadb mariadb *
nodejs node.js *
nodejs node.js *
nodejs node.js *
nodejs node.js *
nodejs node.js *
nodejs node.js *
nodejs node.js *
openssl openssl 1.1.1
nodejs node.js 12
nodejs node.js 14.0
openssl openssl 1.0.2
openssl openssl 3.0.0
ibm aix 7.1
ibm rational clearcase 8.0.1
ibm rational clearcase 8.0.0
ibm i 7.2
ibm websphere mq 5.3.1
ibm watson explorer 11.0.0
ibm netcool/system service monitor 4.0.1
ibm i 7.3
ibm watson explorer 11.0.1
ibm aix 7.2
ibm watson explorer 11.0.2
ibm rational clearquest 9.0.1
ibm workload scheduler 9.4
ibm business process manager 8.6.0.0
ibm rational clearcase 9.0.1
ibm infosphere information server 11.7
ibm spectrum protect plus 10.1.0
ibm business automation workflow 18.0.0.0
ibm qradar security information and event manager 7.3
ibm qradar network security 5.4.0
ibm business automation workflow 18.0.0.1
ibm watson explorer 12.0.0
ibm sterling connect:express 1.5.0
ibm app connect 11.0.0.0
ibm integration bus 10.0.0.0
ibm qradar network security 5.5.0
ibm sterling connect:direct 6.0.0
ibm business automation workflow 19.0.0.1
ibm watson explorer 12.0.1
ibm watson explorer 12.0.2
ibm i 7.4
ibm qradar network packet capture 7.3
ibm vios 3.1
ibm cloud transformation advisor 2.0.1
ibm iot messagesight 5.0.0.0
ibm cloud pak for automation 19.0.3
ibm business automation workflow 19.0.0.3
ibm business process manager 8.5.0.0
ibm mq for hpe nonstop 8.1.0
ibm watson explorer 12.0.3
ibm security guardium 11.0
ibm security guardium 11.1
ibm qradar security information and event manager 7.4 -
ibm cloud pak for automation 20.0.1
ibm rational clearquest 9.0.0
ibm rational clearquest 9.0.2
ibm security identity manager virtual appliance 7.0.2
ibm event streams 10.0.0
ibm cloud pak for automation 20.0.2
ibm security guardium 11.2
ibm business automation workflow 20.0.0.1
ibm event streams 10.1.0
ibm business automation workflow 20.0.0.2
ibm cloud pak for automation 20.0.3
ibm voice gateway 1.0.7
ibm workload scheduler 9.5
ibm security guardium 11.3
ibm event streams 10.2.0
ibm cloud pak for automation 21.0.1
ibm app connect enterprise 12.0.1.0
ibm cloud pak for automation 21.0.2 -
ibm event streams 10.3.0
ibm event streams 10.3.1
ibm hardware management console 9.2.950.0
ibm security guardium 11.4
ibm app connect enterprise certified container 1.1.0
ibm aix 7.3
ibm cloud pak for automation 19.0.1
ibm business automation workflow 21.0.3
ibm qradar security information and event manager 7.5.0 -
ibm robotic process automation 21.0.0
ibm cloud pak for automation 19.0.2
ibm spectrum copy data management 2.2.0.0
ibm business automation workflow 21.0.1
ibm robotic process automation 21.0.1
ibm robotic process automation 21.0.2
ibm app connect enterprise 12.0.4.0
ibm spectrum virtualize 8.2
ibm spectrum copy data management 2.2.15.0
ibm spectrum protect client 8.1.0.0
ibm security verify governance 10.0
ibm spectrum virtualize 7.8
ibm cloud pak for security 1.10.0.0
ibm cloud pak for security 1.10.6.0
ibm safer payments 6.1.0.00
ibm safer payments 6.2.0.00
ibm safer payments 6.3.0.00
ibm safer payments 6.4.0.00
Denotes that component is vulnerable