Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
mail address or phone number, depending on messaging configuration, and the one-time code must be entered in the Privacy Center UI by the data subject before the privacy or consent request is submitted. It was identified that the one-time code values for these requests were generated by the python `random` module, a cryptographically weak pseduo-random number generator (PNRG). If an attacker generates several hundred consecutive one-time codes, this vulnerability allows the attacker to predict all future one-time code values during the lifetime of the backend python process. There is no security impact on data access requests as the personal data download package is not shared in the Privacy
. There is no security impact on data access requests as the personal data download package is not shared in the Privacy Center itself. However, this vulnerability allows an attacker to (i) submit a verified data erasure request, resulting in deletion of data for the targeted user and (ii) submit a verified consent request, modifying a user's privacy preferences. The vulnerability has been patched in Fides version `2.24.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fi
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-82vr-5769-6358 - https://github.com/ethyca/fides/commit/685bae61c203d29ed189f4b066a5223a9bb774c6 - https://peps.python.org/pep-0506/
CVE ID: CVE-2023-48225 State: PUBLISHED Published: 2023-12-12T20:33:40.959Z Last Updated: 2024-08-02T21:23:39.023Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: labring Products: laf Problem Types: CWE-200 Description: Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another obj, the name of the obj itself will be used as the key, and the entire object structure will be integrated intact. When constructing the deployment in
will be used as the key, and the entire object structure will be integrated intact. When constructing the deployment instance of the app, env was found from the database and directly inserted into the template, resulting in controllability here. Sensitive information in the secret and configmap can be read through the k8s envFrom field. In a privatization environment, when `namespaceConf. fixed` is marked, it may lead to the leakage of sensitive information in the system. As of time of publication, it is unclear whether any patches or workarounds exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp - h
Notes: - CVE Program Container: References: - https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp - https://github.com/labring/laf/blob/main/server/src/application/environment.controller.ts#L50 - https://github.com/labring/laf/blob/main/server/src/instance/instance.service.ts#L306
CVE ID: CVE-2023-48226 State: PUBLISHED Published: 2023-11-21T19:37:57.103Z Last Updated: 2024-08-02T21:23:39.200Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: openreplay Products: openreplay Problem Types: CWE-20, CWE-94 Description: OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that
is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4 - https://bugcrowd.com/vulnerability-rating-taxonomy - https://capec.mitre.org/data/definitions/242.html - https://cwe.mitre.org/data/definitions/20.html - https://github.com/openreplay/openrep
e.org/data/definitions/242.html - https://cwe.mitre.org/data/definitions/20.html - https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421
CVE ID: CVE-2023-48227 State: PUBLISHED Published: 2023-12-12T17:12:02.046Z Last Updated: 2024-08-28T14:47:00.241Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-863 Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2
CVE ID: CVE-2023-48228 State: PUBLISHED Published: 2023-11-21T20:48:32.552Z Last Updated: 2024-08-02T21:23:39.088Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: goauthentik Products: authentik Problem Types: CWE-287 Description: authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the token step. Prior to versions 2023.10.4 and 2023.8.5, authentik checks if the contents of `code_verifier` is matching only when it is provided. When it is left out completely, au
entik checks if the contents of `code_verifier` is matching only when it is provided. When it is left out completely, authentik simply accepts the token request with out it; even when the flow was started with a `code_challenge`. authentik 2023.8.5 and 2023.10.4 fix this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-fm34-v8xq-f2c3 - https://github.com/goauthentik/authentik/pull/7666 - https://github.com/goauthentik/authentik/pull/7668 - https://github.com/goauthentik/authentik/pull/7669 - https://github.com/goauthentik/authentik/commit/3af77ab3821fe9c7df8055ba5eade3d1ecea03a6 - https://github.com/goau
669 - https://github.com/goauthentik/authentik/commit/3af77ab3821fe9c7df8055ba5eade3d1ecea03a6 - https://github.com/goauthentik/authentik/commit/6b9afed21f7c39f171a4a445654cfe415bba37d5 - https://github.com/goauthentik/authentik/commit/b88e39411c12e3f9e04125a7887f12354f760a14 - https://github.com/goauthentik/authentik/blob/dd4e9030b4e667d3720be2feda24c08972602274/authentik/providers/oauth2/views/token.py#L225 - https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.4 - https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.5
CVE ID: CVE-2023-48229 State: PUBLISHED Published: 2024-02-14T18:30:31.708Z Last Updated: 2024-08-02T21:23:39.188Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-787 Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds write exists in the driver for IEEE 802.15.4 radios on nRF platforms in the Contiki-NG operating system. The problem is triggered when parsing radio frames in the `read_frame` function in the `arch/cpu/nrf/net/nrf-ieee-driver-arch.c` module. More specifically, the `read_frame` function performs an incomplete validation of the
et/nrf-ieee-driver-arch.c` module. More specifically, the `read_frame` function performs an incomplete validation of the payload length of the packet, which is a value that can be set by an external party that sends radio packets to a Contiki-NG system. Although the value is validated to be in the range of the MTU length, it is not validated to fit into the given buffer into which the packet will be copied. The problem has been patched in the "develop" branch of Contiki-NG and is expected to be included in subsequent releases. Users are advised to update their develop branch or to update to a subsequent release when available. Users unable to upgrade should consider manually applying the cha
h or to update to a subsequent release when available. Users unable to upgrade should consider manually applying the changes in PR #2741. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-rcwv-xwc9-5hp2 - https://github.com/contiki-ng/contiki-ng/pull/2741
CVE ID: CVE-2023-48230 State: PUBLISHED Published: 2023-11-21T20:53:34.151Z Last Updated: 2024-08-02T21:23:39.104Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: capnproto Products: capnproto Problem Types: CWE-124 Description: Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebSocket compression enabled, a buffer underrun can be caused by a remote peer. The underrun always writes a constant value that is not attacker-controlled, likely resulting in a crash, enabling a remote denial-of-service attack. Most Cap'n Proto and KJ users are unlikely to have this functionality
crash, enabling a remote denial-of-service attack. Most Cap'n Proto and KJ users are unlikely to have this functionality enabled and so unlikely to be affected. Maintainers suspect only the Cloudflare Workers Runtime is affected. If KJ HTTP is used with WebSocket compression enabled, a malicious peer may be able to cause a buffer underrun on a heap-allocated buffer. KJ HTTP is an optional library bundled with Cap'n Proto, but is not directly used by Cap'n Proto. WebSocket compression is disabled by default. It must be enabled via a setting passed to the KJ HTTP library via `HttpClientSettings` or `HttpServerSettings`. The bytes written out-of-bounds are always a specific constant 4-byte stri
`HttpClientSettings` or `HttpServerSettings`. The bytes written out-of-bounds are always a specific constant 4-byte string `{ 0x00, 0x00, 0xFF, 0xFF }`. Because this string is not controlled by the attacker, maintainers believe it is unlikely that remote code execution is possible. However, it cannot be ruled out. This functionality first appeared in Cap'n Proto 1.0. Previous versions are not affected. This issue is fixed in Cap'n Proto 1.0.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/capnproto/capnproto/security/advisories/GHSA-r89h-f468-62w3 - https://github.com/capnproto/capnproto/commit/75c5c1499aa6e7690b741204ff9af91cce526c59 - https://github.
89h-f468-62w3 - https://github.com/capnproto/capnproto/commit/75c5c1499aa6e7690b741204ff9af91cce526c59 - https://github.com/capnproto/capnproto/commit/e7f22da9c01286a2b0e1e5fbdf3ec9ab3aa128ff
CVE ID: CVE-2023-48231 State: PUBLISHED Published: 2023-11-16T22:59:37.681Z Last Updated: 2025-02-13T17:18:12.187Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: vim Products: vim Problem Types: CWE-416 Description: Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: Reference
ade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-8g46-v9ff-c765 - https://github.com/vim/vim/commit/25aabc2b8ee1e19ced6f4da9d866cf9378fc4c5a - http://www.openwall.com/lists/oss-security/2023/11/16/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75E
3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/ - https://security.netapp.com/advisory/ntap-20231227-0008/
CVE ID: CVE-2023-48232 State: PUBLISHED Published: 2023-11-16T22:57:17.462Z Last Updated: 2025-02-13T17:18:12.781Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: vim Products: vim Problem Types: CWE-755 Description: Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag. This may happen when a window border is present and when the wrapped line continues on the next physical line directly in the window border because the 'cpo' setting includes the 'n' flag. Only users with non-default settings are affected a
n the window border because the 'cpo' setting includes the 'n' flag. Only users with non-default settings are affected and the exception should only result in a crash. This issue has been addressed in commit `cb0b99f0` which has been included in release version 9.0.2107. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-f6cx-x634-hqpw - https://github.com/vim/vim/commit/cb0b99f0672d8446585d26e998343dceca17d1ce - http://www.openwall.com/lists/oss-security/2023/11/16/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedor
penwall.com/lists/oss-security/2023/11/16/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/ - https://security.netapp.com/advisory/ntap-20231227-0006/
CVE ID: CVE-2023-48233 State: PUBLISHED Published: 2023-11-16T22:55:31.353Z Last Updated: 2025-02-13T17:18:13.412Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: vim Products: vim Problem Types: CWE-190 Description: Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `ac6378773` which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.
cluded in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-3xx4-hcq6-r2vj - https://github.com/vim/vim/commit/ac63787734fda2e294e477af52b3bd601517fa78 - http://www.openwall.com/lists/oss-security/2023/11/16/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/pa
nce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/ - https://security.netapp.com/advisory/ntap-20231227-0003/
CVE ID: CVE-2023-48234 State: PUBLISHED Published: 2023-11-16T22:52:50.866Z Last Updated: 2025-02-13T17:18:14.035Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: vim Products: vim Problem Types: CWE-190 Description: Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes:
.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-59gw-c949-6phq - https://github.com/vim/vim/commit/58f9befca1fa172068effad7f2ea5a9d6a7b0cca - http://www.openwall.com/lists/oss-security/2023/11/16/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedora
/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/ - https://security.netapp.com/advisory/ntap-20231227-0004/
CVE ID: CVE-2023-48235 State: PUBLISHED Published: 2023-11-16T22:50:57.878Z Last Updated: 2025-02-13T17:18:14.589Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: vim Products: vim Problem Types: CWE-190 Description: Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release vers
even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-6g74-hr6q-pr8g - https://github.com/vim/vim/commit/060623e4a3bc72b011e7cd92bedb3bfb64e06200 - http://www.openwall.com/lists/oss-security/2023/11/16/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraprojec
ge/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/ - https://security.netapp.com/advisory/ntap-20231227-0007/
CVE ID: CVE-2023-48236 State: PUBLISHED Published: 2023-11-16T22:47:53.519Z Last Updated: 2025-02-13T17:18:15.181Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: vim Products: vim Problem Types: CWE-190 Description: Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit `73b2d379` which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst N
sion 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-pr4c-932v-8hx5 - https://github.com/vim/vim/commit/73b2d3790cad5694fc0ed0db2926e4220c48d968 - http://www.openwall.com/lists/oss-security/2023/11/16/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.
ct.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/ - https://security.netapp.com/advisory/ntap-20231227-0002/
CVE ID: CVE-2023-48237 State: PUBLISHED Published: 2023-11-16T22:45:57.667Z Last Updated: 2025-02-13T17:18:15.798Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: vim Products: vim Problem Types: CWE-190 Description: Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for
6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-f2m2-v387-gv87 - https://github.com/vim/vim/commit/6bf131888a3d1de62bbfa8a7ea03c0ddccfd496e - http://www.openwall.com/lists/oss-security/2023/11/16/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.
s/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/ - https://security.netapp.com/advisory/ntap-20231227-0005/