External control of file name or path in cURL - CVE-2023-38546

Vulnerability identifier: #VU81863

CSH Severity: Low

CVSS v4: 1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-38546

CWE-ID: CWE-73

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an attacker to inject arbitrary cookies into request.

The vulnerability exists due to the way cookies are handled by libcurl. If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl.

cURL
My Cloud Home
My Cloud Home Duo
IBM Qradar SIEM
My Cloud EX2 Ultra
My Cloud (P/N: WDBCTLxxxxxx-10)
My Cloud EX2100
My Cloud DL4100
My Cloud Mirror Gen 2
My Cloud EX4100
My Cloud PR4100
My Cloud PR2100
RUGGEDCOM APE1808
Dell EMC VxRail Appliance
Oracle Linux
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
PowerSC
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
FortiOS
IBM AIX
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
macOS
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
Basesystem Module
openSUSE Leap
openEuler
Fedora
My Cloud OS 5
Junos OS
Service Interconnect
Red Hat OpenShift Builds
Red Hat OpenShift Kernel Module Management
Migration Toolkit for Runtimes
cert-manager Operator for Red Hat OpenShift
Cryostat
Migration Toolkit for Virtualization
Splunk User Behavior Analytics (UBA)
OpenShift Logging
Red Hat Migration Toolkit for Applications
Red Hat OpenStack
IBM MQ Operator
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Cloud Transformation Advisor
IBM Cloud Object Storage Systems
EasyApache
App Connect Enterprise Certified Container
Dell Secure Connect Gateway
IBM Safer Payments
IBM Security Verify Governance
IBM QRadar WinCollect Agent
EMC NetWorker Server
OSS Network Utilities
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
VMware Horizon Client
Telemetry Dashboard
Dell EMC PowerProtect Data Protection
Cloud Pak for Network Automation
Liquidware
IBM Engineering Requirements Management DOORS Next
SmartFabric OS10
webMethods Managed File Transfer
Oracle Business Intelligence Enterprise Edition
Citrix Workspace App
Webex App VDI
ObjectScale
Storage Copy Data Management
Enterprise SONiC
Platform Automation Toolkit
Storage Ceph
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect Backup-Archive Client
IBM supplied MQ Advanced container images
Total Storage Service Console (TSSC) / TS4500 IMC
Storage Protect Plus Server
Network Observability plugin for the Openshift Console
Red Hat OpenShift GitOps
OpenShift Service Mesh
OpenShift Virtualization
OpenShift Container Platform for Windows Containers
VMware Tanzu Operations Manager
OpenShift Data Foundation (formerly OpenShift Container Storage)
SecurityCenter
Juniper Secure Analytics (JSA)
Red Hat Single Sign-On
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
curl (Ubuntu package)
libcurl3-gnutls (Ubuntu package)
libcurl3-nss (Ubuntu package)
libcurl4 (Ubuntu package)
libcurl3 (Ubuntu package)
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-openssl-chil (Red Hat package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
katello-agent (Red Hat package)
katello-host-tools (Red Hat package)
puppet-agent (Red Hat package)
libcurl-devel
curl
libcurl4-32bit
libcurl4-32bit-debuginfo
libcurl4-debuginfo
curl-debugsource
libcurl4
curl-debuginfo
curl (Red Hat package)
curl-minimal
libcurl
libcurl-minimal
curl-doc
curl-help
curl (Debian package)
libcurl4-debuginfo-32bit
libcurl4-64bit
libcurl4-64bit-debuginfo
libcurl-devel-64bit
libcurl-devel-32bit
net-misc/curl
jbcs-httpd24-curl (Red Hat package)
IBM App Connect Enterprise
IBM CICS TX Advanced
Cisco Jabber
Cisco Webex Meetings
JBoss Core Services
AMQ Broker
RecoverPoint for VMs
Red Hat Ceph Storage

Install updates from vendor's website.

cURL - update to 8.4.0
OSS Network Utilities - update to T1204L01^AAI
Red Hat OpenShift Builds - update to 1.0.1
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
Red Hat OpenShift Kernel Module Management - update to 1.1.2
Migration Toolkit for Runtimes - update to 1.2.5
Network Observability plugin for the Openshift Console - update to 1.5.0
Migration Toolkit for Containers - update to 1.7.15
Red Hat OpenShift GitOps - addressed in versions 1.9.3, 1.10.4, 1.11.3, 1.12.1
cert-manager Operator for Red Hat OpenShift - addressed in versions 1.11.5, 1.12.1
Migration Toolkit for Virtualization - addressed in versions 2.4.3, 2.5.2
OpenShift Service Mesh - update to 2.5.1
Dell EMC PowerProtect Data Protection - update to 2.7.8
Cloud Pak for Network Automation - update to 2.7.4
Red Hat OpenShift Container Platform - addressed in versions 4.11.54, 4.12.40, 4.12.43, 4.12.44, 4.12.58, 4.13.19, 4.13.22, 4.14.0, 4.14.2
OpenShift Virtualization - addressed in versions 4.12.9, 4.13.5, 4.13.6, 4.14.1
Splunk User Behavior Analytics (UBA) - update to 5.4.3
OpenShift Logging - addressed in versions 5.6.18, 5.7.13, 5.8.1
SecurityCenter - update to SC-202310.1
Red Hat Migration Toolkit for Applications - addressed in versions 6.2, 6.2.1, 7.0.3
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
FortiOS - addressed in versions 7.2.7, 7.4.2
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
Red Hat Single Sign-On - update to 7.6.8
OpenShift Container Platform for Windows Containers - addressed in versions 9.0.1, 10.15.0
My Cloud Home - update to 9.7.0-104
My Cloud Home Duo - update to 9.7.0-104
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
SmartFabric OS10 - addressed in versions 10.5.4.11, 10.5.6.1
macOS - addressed in versions 12.7.3 21H1015, 13.6.4 22G513, 14.2 23C64
IBM App Connect Enterprise - update to 12.0.10.1
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Red Hat OpenStack - addressed in versions 16.2, 17.1.1
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
curl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.68.0-1ubuntu2.20, 7.81.0-1ubuntu1.14, 7.88.1-8ubuntu2.3, 8.2.1-1ubuntu3.1
libcurl3-gnutls (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.68.0-1ubuntu2.20, 7.81.0-1ubuntu1.14, 7.88.1-8ubuntu2.3, 8.2.1-1ubuntu3.1
libcurl3-nss (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.68.0-1ubuntu2.20, 7.81.0-1ubuntu1.14, 7.88.1-8ubuntu2.3, 8.2.1-1ubuntu3.1
libcurl4 (Ubuntu package) - addressed in versions Ubuntu Pro, 7.68.0-1ubuntu2.20, 7.81.0-1ubuntu1.14, 7.88.1-8ubuntu2.3, 8.2.1-1ubuntu3.1
libcurl3 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
jbcs-httpd24-openssl-pkcs11 (Red Hat package) - addressed in versions 0.4.10-34.el7jbcs, 0.4.10-34.el8jbcs
jbcs-httpd24-openssl-chil (Red Hat package) - addressed in versions 1.0.0-19.el7jbcs, 1.0.0-19.el8jbcs
jbcs-httpd24-mod_proxy_cluster (Red Hat package) - addressed in versions 1.3.19-7.el7jbcs, 1.3.19-7.el8jbcs
ObjectScale - update to 1.4.0
jbcs-httpd24-apr-util (Red Hat package) - addressed in versions 1.6.1-103.el7jbcs, 1.6.1-103.el8jbcs
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.19-32.el7jbcs, 1.15.19-32.el8jbcs
IBM MQ Operator - addressed in versions 2.0.16, 2.4.4
Storage Copy Data Management - update to 2.2.24.0
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.4.24-2.el7jbcs, 2.4.24-2.el8jbcs
JBoss Core Services - update to 2.4.57 SP2
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.57-7.el7jbcs, 2.4.57-7.el8jbcs
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.3-32.el7jbcs, 2.9.3-32.el8jbcs
VMware Tanzu Operations Manager - update to 2.10.63
Isolation Segment - addressed in versions 3.0.19, 4.0.11
VMware Tanzu Application Service for VMs - addressed in versions 3.0.19, 4.0.11
IBM Cloud Transformation Advisor - update to 3.10.0
IBM Cloud Object Storage Systems - addressed in versions 3.17.0.128, 3.17.5.100
Enterprise SONiC - update to 4.2.1
katello-agent (Red Hat package) - addressed in versions 4.2.3-5.el6sat, 4.2.3-5.el7sat, 4.2.3-5.el8sat, 4.2.3-5.el9sat
katello-host-tools (Red Hat package) - addressed in versions 4.2.3-5.el6sat, 4.2.3-5.el7sat, 4.2.3-5.el8sat, 4.2.3-5.el9sat
Platform Automation Toolkit - addressed in versions 4.4.32, 5.0.25, 5.1.2
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.14.0
EasyApache - update to 4 2023-10-12
App Connect Enterprise Certified Container - addressed in versions 5.0.17, 11.5.0
Dell Secure Connect Gateway - update to 5.20.00.10
My Cloud OS 5 - update to 5.30.103
RecoverPoint for VMs - update to 6.0.SP1.P1
Red Hat Ceph Storage - update to 6.1
Storage Ceph - update to 6.1z6
IBM Safer Payments - addressed in versions 6.4.2.06, 6.5.0.04, 6.6.0.02
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
AMQ Broker - update to 7.12.0
puppet-agent (Red Hat package) - addressed in versions 7.28.0-1.el6sat, 7.28.0-1.el7sat, 7.28.0-1.el8sat, 7.28.0-1.el9sat
libcurl-devel - addressed in versions 7.60.0-150000.56.1, 7.66.0-150200.4.60.1, 8.0.1-11.74.1, 8.0.1-150400.5.32.1
curl - addressed in versions 7.60.0-150000.56.1, 7.66.0-150200.4.60.1, 8.0.1-11.74.1, 8.0.1-150400.5.32.1
libcurl4-32bit - addressed in versions 7.60.0-150000.56.1, 7.66.0-150200.4.60.1, 8.0.1-11.74.1, 8.0.1-150400.5.32.1
libcurl4-32bit-debuginfo - addressed in versions 7.60.0-150000.56.1, 7.66.0-150200.4.60.1, 8.0.1-150400.5.32.1
libcurl4-debuginfo - addressed in versions 7.60.0-150000.56.1, 7.66.0-150200.4.60.1, 8.0.1-11.74.1, 8.0.1-150400.5.32.1
curl-debugsource - addressed in versions 7.60.0-150000.56.1, 7.66.0-150200.4.60.1, 8.0.1-11.74.1, 8.0.1-150400.5.32.1
libcurl4 - addressed in versions 7.60.0-150000.56.1, 7.66.0-150200.4.60.1, 8.0.1-11.74.1, 8.0.1-150400.5.32.1
curl-debuginfo - addressed in versions 7.60.0-150000.56.1, 7.66.0-150200.4.60.1, 8.0.1-11.74.1, 8.0.1-150400.5.32.1
curl (Red Hat package) - addressed in versions 7.61.1-22.el8_6.9, 7.61.1-30.el8_8.6, 7.61.1-33.el8_9.5, 7.76.1-14.el9_0.9, 7.76.1-23.el9_2.4, 7.76.1-26.el9_3.2
curl - addressed in versions 7.61.1-34.0.1, 7.61.1-34.0.2, 8.4.0-1
curl-minimal - addressed in versions 7.61.1-34.0.1, 7.61.1-34.0.2, 8.4.0-1
libcurl - addressed in versions 7.61.1-34.0.1, 7.61.1-34.0.2, 8.4.0-1
libcurl-devel - addressed in versions 7.61.1-34.0.1, 7.61.1-34.0.2, 8.4.0-1
libcurl-minimal - addressed in versions 7.61.1-34.0.1, 7.61.1-34.0.2, 8.4.0-1
curl-doc - addressed in versions 7.61.1-34.0.1, 7.61.1-34.0.2, 8.4.0-1
curl - update to 7.71.1-31
curl-debuginfo - update to 7.71.1-31
libcurl - update to 7.71.1-31
libcurl-devel - update to 7.71.1-31
curl-debugsource - update to 7.71.1-31
curl-help - update to 7.71.1-31
curl (Debian package) - addressed in versions 7.74.0-1.3+deb11u10, 7.88.1-10+deb12u4
curl - addressed in versions 7.85.0-12.fc37, 8.0.1-5.fc38, 8.2.1-3.fc39
libcurl4-debuginfo-32bit - update to 8.0.1-11.74.1
libcurl4-64bit - update to 8.0.1-150400.5.32.1
libcurl4-64bit-debuginfo - update to 8.0.1-150400.5.32.1
libcurl-devel-64bit - update to 8.0.1-150400.5.32.1
libcurl-devel-32bit - update to 8.0.1-150400.5.32.1
Dell EMC VxRail Appliance - update to 8.0.311
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.24.0
Storage Protect Backup-Archive Client - update to 8.1.24
net-misc/curl - update to 8.3.0-r2
curl - update to 8.3.0-1
curl - update to 8.4.0
jbcs-httpd24-curl (Red Hat package) - addressed in versions 8.4.0-2.el7jbcs, 8.4.0-2.el8jbcs
IBM supplied MQ Advanced container images - addressed in versions 9.3.0.11-r1, 9.3.3.2-r1
Total Storage Service Console (TSSC) / TS4500 IMC - update to 9.4.31
IBM Security Verify Governance - update to 10.0.2.0.4
IBM CICS TX Advanced - update to 10.1.0.0 ifix24
IBM QRadar WinCollect Agent - update to 10.1.9
Storage Protect Plus Server - update to 10.1.16.3
EMC NetWorker Server - update to 19.10.0.2
Junos OS - addressed in versions 23.4R1-S1, 23.4R2, 24.1R1

• https://curl.haxx.se/docs/CVE-2023-38546.html

• Multiple vulnerabilities in cURL
• Slackware Linux update for curl
• Gentoo update for curl
• SUSE update for curl
• SUSE update for curl
• SUSE update for curl
• Ubuntu update for curl
• Debian update for curl
• Ubuntu update for curl
• Fedora 39 update for curl
• Fedora 38 update for curl
• Fedora 37 update for curl
• Multiple vulnerabilities in cPanel EasyApache
• Red Hat Enterprise Linux 9.0 Extended Update Support update for curl
• Red Hat Enterprise Linux 9.2 Extended Update Support update for curl
• Ubuntu update for curl
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console
• Multiple vulnerabilities in Red Hat OpenStack Platform 17
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in Tenable Security Center
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Red Hat Enterprise Linux 8.6 Extended Update Support update for curl
• Red Hat Enterprise Linux 9 update for curl
• Multiple vulnerabilities in Red Hat Service Interconnect for RHEL 9
• Multiple vulnerabilities in Migration Toolkit for Applications 6.2
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.4
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in IBM Cloud Object System
• Multiple vulnerabilities in IBM App Connect Enterprise
• FortiGate FGT_VM64 update for curl
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in cert-manager Operator for Red Hat OpenShift 1.12
• Multiple vulnerabilities in cert-manager Operator for Red Hat OpenShift 1.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.9
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.14
• Multiple vulnerabilities in Red Hat OpenShift Kernel Module Management 1.1
• Multiple vulnerabilities in HPE NonStop OSS Network Utilities
• Red Hat Enterprise Linux 8.8 Extended Update Support update for curl
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• VMware Tanzu products update for curl
• SUSE update for curl
• Multiple vulnerabilities in Red Hat JBoss Core Services Apache HTTP Server 2.4
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Multiple vulnerabilities in Red Hat JBoss Core Services for RHEL 7 and 8
• Multiple vulnerabilities in IBM AIX
• Multiple vulnerabilities in Red Hat Ceph Storage 6.1
• Multiple vulnerabilities in Logging Subsystem 5.8 for Red Hat OpenShift
• Multiple vulnerabilities in IBM PowerSC
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.5
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in Apple macOS Monterey
• Multiple vulnerabilities in Apple macOS Ventura
• Multiple vulnerabilities in Apple macOS Sonoma
• External control of file name or path in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM QRadar WinCollect Agent
• Multiple vulnerabilities in Red Hat Network Observability
• Multiple vulnerabilities in Red Hat OpenShift for Windows Containers 10.15
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• openEuler update for curl
• Multiple vulnerabilities in Fortigate NGFW on Siemens RUGGEDCOM APE1808 devices
• Multiple vulnerabilities in Red Hat OpenShift for Windows Containers 9.0
• Red Hat Enterprise Linux 8 update for curl
• Multiple vulnerabilities in Red Hat OpenShift Builds
• Multiple vulnerabilities in IBM Safer Payments
• Junos OS and Junos OS Evolved update for cURL
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh Containers 2.5
• Multiple vulnerabilities in Dell Networking OS10
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.10
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat build of Cryostat 2 on RHEL 8
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• Red Hat Satellite Client update for puppet-agent
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Dell Enterprise SONiC Distribution
• Multiple vulnerabilities in Dell NetWorker Server
• Multiple vulnerabilities in OpenShift Logging 5.7
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in AMQ Broker 7.12
• Multiple vulnerabilities in Dell ThinOS
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in Dell SmartFabric OS10
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Dell ObjectScale
• External control of file name or path in IBM Storage Ceph
• Multiple vulnerabilities in IBM Storage Protect Plus
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in IBM Storage Protect for Virtual Environments: Data Protection for Microsoft Hyper-V
• Multiple vulnerabilities in IBM Total Storage Service Console (TSSC) / TS4500 IMC
• Multiple vulnerabilities in Western Digital My Cloud Home & Duo firmware
• Multiple vulnerabilities in Dell VxRail Appliance
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Amazon Linux AMI update for curl
• Amazon Linux AMI update for ecs-service-connect-agent
• Multiple vulnerabilities in Western Digital My Cloud OS 5
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client
• Anolis OS update for curl
• Anolis OS update for curl
• Anolis OS update for curl
• PowerProtect Data Protection software update for third-party components
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Splunk User Behavior Analytics (UBA) update for third-party components
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0