CVE-2020-15706

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.

CVSS v3 6.4 MEDIUM
CVSS v2.0 4.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.4^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html	Broken Link Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html	Broken Link Mailing List Third Party Advisory
http://ubuntu.com/security/notices/USN-4432-1	Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/07/29/3	Mailing List Third Party Advisory
https://access.redhat.com/security/vulnerabilities/grub2bootloader	Third Party Advisory
https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html	Issue Tracking Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011	Patch Third Party Advisory Vendor Advisory
https://security.gentoo.org/glsa/202104-05	Third Party Advisory
https://security.netapp.com/advisory/ntap-20200731-0008/	Third Party Advisory
https://usn.ubuntu.com/4432-1/	Third Party Advisory
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass	Third Party Advisory
https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot	Third Party Advisory
https://www.debian.org/security/2020/dsa-4735	Third Party Advisory
https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/	Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/07/29/3	Mailing List Third Party Advisory
https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/	Third Party Advisory
https://www.suse.com/support/kb/doc/?id=000019673	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html	Broken Link Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html	Broken Link Mailing List Third Party Advisory
http://ubuntu.com/security/notices/USN-4432-1	Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/07/29/3	Mailing List Third Party Advisory
https://access.redhat.com/security/vulnerabilities/grub2bootloader	Third Party Advisory
https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html	Issue Tracking Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011	Patch Third Party Advisory Vendor Advisory
https://security.gentoo.org/glsa/202104-05	Third Party Advisory
https://security.netapp.com/advisory/ntap-20200731-0008/	Third Party Advisory
https://usn.ubuntu.com/4432-1/	Third Party Advisory
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass	Third Party Advisory
https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot	Third Party Advisory
https://www.debian.org/security/2020/dsa-4735	Third Party Advisory
https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/	Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/07/29/3	Mailing List Third Party Advisory
https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/	Third Party Advisory
https://www.suse.com/support/kb/doc/?id=000019673	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:redhat:enterprise_linux_atomic_host:-:::::::*
	cpe:2.3:a:redhat:openshift_container_platform:4.0:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::
	cpe:2.3:o:debian:debian_linux:10.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:suse:suse_linux_enterprise_server:11:::::::*
	cpe:2.3:o:suse:suse_linux_enterprise_server:12:::::::*
	cpe:2.3:o:suse:suse_linux_enterprise_server:15:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:microsoft:windows_10:-:::::::*
	cpe:2.3:o:microsoft:windows_10:1607:::::::*
	cpe:2.3:o:microsoft:windows_10:1709:::::::*
	cpe:2.3:o:microsoft:windows_10:1803:::::::*
	cpe:2.3:o:microsoft:windows_10:1809:::::::*
	cpe:2.3:o:microsoft:windows_10:1903:::::::*
	cpe:2.3:o:microsoft:windows_10:1909:::::::*
	cpe:2.3:o:microsoft:windows_10:2004:::::::*
	cpe:2.3:o:microsoft:windows_8.1:-:::::::*
	cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:1903:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:1909:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:2004:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

Configuration 4 (hide)

OR	cpe:2.3:o:opensuse:leap:15.1:::::::*
	cpe:2.3:o:opensuse:leap:15.2:::::::*

Configuration 5 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::

History

21 Nov 2024, 05:06

Information

Published : 2020-07-29 18:15

Updated : 2024-11-21 05:06

NVD link : CVE-2020-15706

Mitre link : CVE-2020-15706

CVE.ORG link : CVE-2020-15706

JSON object : View

Products Affected

debian

debian_linux

microsoft

windows_server_2016
windows_8.1
windows_rt_8.1
windows_server_2019
windows_10
windows_server_2012

redhat

enterprise_linux
enterprise_linux_atomic_host
openshift_container_platform

gnu

grub2

suse

suse_linux_enterprise_server

canonical

ubuntu_linux

opensuse

leap

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-416

Use After Free

{"id": "CVE-2020-15706", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}]}, "published": "2020-07-29T18:15:14.420", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html", "tags": ["Broken Link", "Mailing List", "Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html", "tags": ["Broken Link", "Mailing List", "Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "http://ubuntu.com/security/notices/USN-4432-1", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "http://www.openwall.com/lists/oss-security/2020/07/29/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://access.redhat.com/security/vulnerabilities/grub2bootloader", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011", "tags": ["Patch", "Third Party Advisory", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://security.gentoo.org/glsa/202104-05", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://security.netapp.com/advisory/ntap-20200731-0008/", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://usn.ubuntu.com/4432-1/", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://www.debian.org/security/2020/dsa-4735", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://www.openwall.com/lists/oss-security/2020/07/29/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://www.suse.com/support/kb/doc/?id=000019673", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html", "tags": ["Broken Link", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html", "tags": ["Broken Link", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://ubuntu.com/security/notices/USN-4432-1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2020/07/29/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/security/vulnerabilities/grub2bootloader", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011", "tags": ["Patch", "Third Party Advisory", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/202104-05", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20200731-0008/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://usn.ubuntu.com/4432-1/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2020/dsa-4735", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.openwall.com/lists/oss-security/2020/07/29/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.suse.com/support/kb/doc/?id=000019673", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-362"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions."}, {"lang": "es", "value": "GRUB2 contiene una condici\u00f3n de carrera en la funci\u00f3n grub_script_function_create() que conlleva a una vulnerabilidad de uso de la memoria previamente liberada la cual puede ser desencadenada al redefinir una funci\u00f3n mientras la misma funci\u00f3n ya se est\u00e1 ejecutando, conllevando a una ejecuci\u00f3n de c\u00f3digo arbitrario y a una omisi\u00f3n de restricci\u00f3n de arranque seguro. Este problema afecta a GRUB2 versiones 2.04 y versiones anteriores"}], "lastModified": "2024-11-21T05:06:03.823", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC3627EF-FE69-44D7-96D5-E40FF30ED38B", "versionEndIncluding": "2.04"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:enterprise_linux_atomic_host:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF483911-003B-470B-A12B-85EF34A50469"}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB"}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93AD897C-C9F7-4B4D-BC39-5E13920383D4"}, {"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C649194-B8C2-49F7-A819-C635EE584ABF"}, {"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF73A3D9-6566-4CBF-AA5F-5A4B99719A1D"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21540673-614A-4D40-8BD7-3F07723803B0"}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E01A4CCA-4C43-46E0-90E6-3E4DBFBACD64"}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83B14968-3985-43C3-ACE5-8307196EFAE3"}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CB85C75-4D35-480E-843D-60579EC75FCB"}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B8F3DD2-A145-4AF1-8545-CC42892DA3D1"}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FB5CDAE-C713-4D9D-9D6A-2C2E8924A4BB"}, {"criteria": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9273B95-20ED-4547-B0A8-95AD15B30372"}, {"criteria": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAE74AF3-C559-4645-A6C0-25C3D647AAC8"}, {"criteria": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E93068DB-549B-45AB-8E5C-00EB5D8B5CF8"}, {"criteria": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6CE5198-C498-4672-AF4C-77AB4BE06C5C"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B921FDB-8E7D-427E-82BE-4432585080CF"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C253A63F-03AB-41CB-A03A-B2674DEA98AA"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B60D940-80C7-49F0-8F4E-3F99AC15FA82"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"}, {"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}

6.4 /10